Chrome and Edge V8 Zero-Day: Fixed Versions and Current Status

The world's most-used browser, Google Chrome, carried a serious flaw (a security weakness) in V8, the engine at its heart, that was used in real attacks. It is tracked as CVE-2026-11645. The flaw was fixed in Chrome 149.0.7827.102/.103, released on June 8, 2026. If you are on that version or later (including the current 150 series), no action is needed. On anything older, simply opening a booby-trapped web page can let an attacker's code start running on your device.

Browsers built on the same foundation as Chrome (Chromium) shared this flaw: Microsoft Edge, Brave, Opera and others. Edge closed it in 149.0.4022.69 (shipped around June 16, 2026), and every major Chromium browser is safe on its current version.

This was a flaw abused before a fix was ready, what's called a "zero-day," and the fifth for Chrome in 2026. Google acknowledged that an exploit for this flaw existed in the wild, and on June 9, 2026 the U.S. agency CISA added it to its catalog of vulnerabilities under active attack (KEV). A month and a half after the fix, as of July 23, 2026, no new exploited Chrome zero-day has been reported; this one remains the most recent of 2026.

How to check whether your browser is patched

This flaw is closed once Chrome is on 149.0.7827.102/.103 (desktop) or later. Chrome updates itself by default, so if you use it normally you should already be on the current 150 series (150.0.7871.181/.182 shipped on July 21, 2026). To check, click the "⋮" (three dots) at the top right of Chrome and open "Help" → "About Google Chrome." Your version is shown, and any pending update is applied automatically. If an update runs, be sure to click "Relaunch" to apply it. If you only downloaded the update but never relaunched, you keep running the old, vulnerable version.

The rollout of the fix is long complete. What to watch for now is machines that haven't been started in a long time, or environments where automatic updates are turned off. A Chrome opened after weeks away starts on its old version, so run "About Chrome" and relaunch before you browse. If you manage many PCs at work, have IT audit for any devices still unpatched. Note that Chrome on iPhone runs on Apple's engine (WebKit) and is not the direct target of this V8 flaw, but keeping the whole OS up to date matters regardless.

What happens, and why just opening a trap page is dangerous

The flaw was in "V8," the heart of Chrome. V8 is the engine that runs the programs (JavaScript) written into web pages quickly, and it runs for nearly every page you view. CVE-2026-11645 is a bug where V8 reads and writes memory outside the range it should. The technical classes are out-of-bounds read (CWE-125) and out-of-bounds write (CWE-787), and the severity is rated a high 8.8 out of 10.

What's frightening is how easy the attack is. Per NVD (the U.S. vulnerability database), an attacker only has to get you to open a crafted HTML page (that is, an ordinary web page) to run their code inside Chrome. No suspicious file to download, nothing to install. It can happen the instant you open a page reached via an ad, a hijacked legitimate site, or a link in email or social media. Chrome has a safety mechanism called the "sandbox" (an isolation box) to contain damage, but memory flaws like this are known to be used as a stepping stone to break out of that box.

And this was a "zero-day" — a flaw already used in attacks before a fix existed. Google acknowledged that an exploit was circulating, but it has not published details of the method or the attackers, and as of July 23, 2026, a month and a half after the fix, there has been no follow-up. Withholding details is Chrome's standard practice, because publishing them would help other attackers target those who haven't patched. Put the other way: a device that still hasn't updated could be hit at any time using a technique attackers already know.

Who targets this flaw, and what they're after

You might think, "a browser bug, really?" But the browser is now where we keep our work, our money, and our relationships. Online banking, work email and systems, social media, shopping, saved passwords — Chrome is the doorway to all of it. A flaw that lets someone inside that Chrome just by getting you to open a trap page is, to an attacker, close to a master key. The fact that an exploit actually circulated for this flaw means people who wanted that value were actively moving.

The ones coming for it are not an abstract "hacker." Concretely, they are state-backed espionage groups who want to quietly plant surveillance tools on a specific person's device, surveillance vendors who target journalists, activists, and executives to siphon communications and location, money-driven crime groups who steal saved logins and cookies to take over bank accounts and online accounts, and brokers who resell the break-in paths they harvest. What they want is your saved passwords and logged-in sessions, your online-banking screens, your work correspondence, and your contacts and photos. The instant a crafted page is opened in Chrome, the first step toward all of the above passes to the attacker's side.

What makes zero-days especially nasty is that the first target is often "one specific person." Many zero-days used in real attacks start in sophisticated operations against particular high-value individuals, and only later does the technique spread down to ordinary users. So here too, even if the attacks are currently limited to select targets, once the technique gets out, the damage can spread — via trap ads and hijacked sites — to everyday people just reading news sites or watching videos.

And the ones who bear the harm are not some special few; they are perfectly ordinary users who put off updating. Unauthorized bank transfers, hijacked social accounts via impersonation, company data walking out, leaked family photos and contacts — the number 8.8 is only a gauge of technical severity, and what a single trap page actually costs you is your life and work themselves. The update takes a few minutes. Whether you spare those minutes is what decides whether you become the one who gets hit.

The fifth of 2026: why the browser's core keeps getting targeted

CVE-2026-11645 is the fifth exploited Chrome zero-day Google fixed in 2026. Media covering it called the situation "Whac-A-Mole." The one just before it (the fourth) was also an attacker-used flaw patched in a hurry, with the same story repeating at short intervals. This flaw was reported by an anonymous researcher in late April 2026, and a $55,000 bounty was reportedly paid for the responsible disclosure.

Why does a component like V8 get targeted again and again? The reason is simple: almost everyone in the world feeds code into it, every day, with their guard down. Every time you open a web page, that page's JavaScript runs in V8. To an attacker, holding a single V8 weakness means they don't need to send you mail or make you open a file — just "show you a page" and they can reach into your device. No other attack surface is this wide and this reliable, which is why large bounties move and attackers concentrate their resources there. The browser's safety box (the sandbox) keeps getting stronger year by year, yet flaws that break it keep getting found — that tug-of-war is what "Whac-A-Mole" really is.

From disclosure to fix

← Swipe to move

Where things stand as of July 23, 2026

The attack details and the scale of harm were never disclosed, while the rollout of the fix quietly finished. For anyone on a current Chrome or Edge, this hole is closed. The remaining risk sits with devices that haven't been updated in a long time and environments where automatic updates are off. Given that the attack could trigger just by opening a page, keeping an unpatched device in use is leaving a broken lock on your front door.

What to check now

At home and at work, the checks are simple.

• Open Chrome's "⋮" → "Help" → "About Google Chrome" and check that you are on 149.0.7827.102 or later (with normal auto-updates you should be on the current 150 series). If older, update and be sure to click "Relaunch"
• On an Android phone, check in the Play Store that Chrome is current (the fixed version has been delivered)
• Edge is fixed on 149.0.4022.69 or later. Brave, Opera, Vivaldi and other Chromium browsers are fine as long as they are up to date
• If you run many devices at work, have IT verify no unpatched devices remain
• On a PC that hasn't been started in a long time, update and relaunch the browser before doing anything else

Prioritize devices used for online banking or work systems. This attack didn't even require opening a file — just displaying a page could be enough, so the old mindset of "I never open suspicious files, so I'm fine" was no protection here. The basic defense is to take fixes quickly once they ship, and leaving your browser's automatic updates on is the easiest way to do that.

FAQ

In summary

CVE-2026-11645 was a zero-day in V8, the heart of the world's most-used browser, Google Chrome, abused in real attacks before a patch existed. It was a serious flaw where merely getting you to open a crafted web page could run an attacker's code on your device, rated 8.8. Google fixed it in Chrome 149.0.7827.102/.103 on June 8, 2026, Microsoft Edge followed with 149.0.4022.69, and CISA added it to its catalog of vulnerabilities under active attack (KEV) on June 9. It was the fifth exploited Chrome zero-day of 2026, and as of July 23, 2026, a month and a half later, no sixth has appeared.

For anyone running a current Chrome or Edge, this hole is closed. Checking takes one step: open "About Google Chrome" and confirm you are on 149.0.7827.102 or later (with normal auto-updates, the current 150 series). The only devices still exposed are those unused for a long time or with automatic updates turned off. Since this attack could trigger just from viewing a page, without opening a file, keeping auto-updates on and your browser current protects you better than any "don't touch suspicious things" habit.

References

• ▸NVD - CVE-2026-11645 (V8 out-of-bounds read/write, CVSS 8.8)
• ▸Help Net Security - Google patches Chrome zero-day exploited in the wild
• ▸SecurityWeek - Google Patches 5th Chrome Zero-Day Exploited in 2026
• ▸BleepingComputer - Google patches fifth Chrome zero-day exploited this year
• ▸The Register - Chrome's zero-day Whac-A-Mole continues
• ▸GovCERT.HK - Microsoft Edge Multiple Vulnerabilities (fixed in Edge 149.0.4022.69)
• ▸Chrome Releases - Stable Channel Updates (July 2026, 150 series)
• ▸CWE-125: Out-of-bounds Read ／ CWE-787: Out-of-bounds Write