Chrome zero-day CVE-2026-11645 exploited in wild

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Google Chrome has a V8 out-of-bounds vulnerability under active exploitation, part of a batch of 74 patched flaws that could enable arbitrary code execution.

Sourcecisecurity.org — open the original

CISA's MS-ISAC issued an advisory covering a large set of vulnerabilities patched in Google Chrome versions prior to 149.0.7827.102/.103. The majority are use-after-free, integer overflow, and input-validation flaws across Chrome components including Bluetooth, V8, Views, Dawn, Printing, and Extensions. The most severe of these, CVE-2026-11645, is an out-of-bounds memory access flaw in the V8 JavaScript engine, and Google has confirmed an exploit for it exists in the wild.

Successful exploitation of the most critical bugs could allow arbitrary code execution in the context of the logged-in user, potentially enabling an attacker to install programs, manipulate or exfiltrate data, or create new accounts with full privileges. Impact severity depends on the privilege level of the affected account, with users on non-administrative accounts facing reduced risk. The primary attack vector described is drive-by compromise, meaning victims could be compromised simply by visiting a malicious or compromised webpage.

Organizations are urged to apply Google's updates immediately following testing, given the confirmed in-the-wild exploitation of CVE-2026-11645. Standard mitigations apply: enforcing least privilege, enabling anti-exploitation features (DEP, WDEG, SIP/Gatekeeper), restricting web-based content, DNS/URL filtering, and user awareness training around malicious links and attachments.

title: Suspicious Child Process Spawned by Google Chrome
id: 3fe317e2-fd58-5469-8007-3bdfccaebb49
status: experimental
description: 'Detects Chrome (or its renderer/utility processes) spawning command
  interpreters, scripting engines, or other LOLBins as child processes. Legitimate
  Chrome behaviour rarely spawns these processes directly; this pattern is consistent
  with successful drive-by exploitation of a browser memory-corruption vulnerability
  such as CVE-2026-11645 leading to arbitrary code execution in the context of the
  logged-in user.

  '
references:
- https://www.cisa.gov
author: Vorant
tags:
- attack.t1189
- attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \chrome.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  filter_updater:
    Image|endswith:
    - \GoogleUpdate.exe
    - \chrome_installer.exe
    CommandLine|contains:
    - --update
    - setup.exe
  condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Chrome-managed installers or Google Update invoking helper processes for legitimate
  updates
- Enterprise browser extension deployment tools that shell out to msiexec or PowerShell
- Print-to-PDF or file download handlers that invoke rundll32 for shell extensions
level: high

title: Chrome Renderer Process Writing Executable File Outside Cache
id: e475373b-296d-57d0-84b5-585b7b6429d8
status: experimental
description: 'Detects the Chrome renderer or GPU process (chrome.exe running in sandboxed
  --type=renderer/--type=gpu-process mode) writing executable, script, or DLL files
  to locations outside the normal Chrome cache/user-data profile. This behaviour can
  indicate a successful sandbox escape following exploitation of a browser vulnerability
  such as CVE-2026-11645, where the attacker drops a second-stage payload to disk.

  '
references:
- https://www.cisa.gov
author: Vorant
tags:
- attack.t1189
- attack.initial-access
logsource:
  category: file_event
  product: windows
detection:
  selection_proc:
    Image|endswith: \chrome.exe
  selection_ext:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .bat
    - .vbs
    - .hta
    - .scr
  filter_normal_paths:
    TargetFilename|contains:
    - \AppData\Local\Google\Chrome\User Data\
    - \Google\Chrome\Application\
    - \Temp\scoped_dir
  condition: selection_proc and selection_ext and not filter_normal_paths
falsepositives:
- Chrome extension or component updates writing DLLs/executables within its own installation
  folders
- Enterprise software that hooks into Chrome download handling and legitimately writes
  files to user Downloads folder
level: medium

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-054

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.