Attackers are using this June 8, 2026 Critical severity

Chrome flaw used in attacks (JavaScript engine)

A flaw in Chrome’s JavaScript engine (V8), “Out of bounds memory access in V8”, lets a booby-trapped web page run code. Google says an exploit exists in the wild. Fixed in Chrome 149.0.7827.102.

On a Mac

Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.

The fix

• Chrome 149.0.7827.102
• Electron 40.10.3, 41.7.2, 42.4.0, 43.0.0, 44.0.0 and 45.0.0

Attacks

In CISA’s catalog of exploited flaws since June 9, 2026.

CVE

CVE-2026-11645

Sources

• chromereleases.googleblog.com
• cisa.gov

From the Briefing, updated 18 minutes ago.