Short answer: Google patched a zero-day vulnerability in Chrome, affecting all users. Keep your browser updated to protect yourself.
TL;DR
- Chrome 157 updates fixed nine vulnerabilities.
- One high-severity flaw was exploited in the wild.
- Updates include fixes for WebGL, FileSystem, and V8 components.
What is CVE-2026-11645?
This incident involves a security update for Google Chrome. A high-severity vulnerability, tracked as CVE-2026-125350, was exploited in the wild, targeting users via a use-after-free issue in the browser's XML component. This is the eighth zero-day vulnerability fixed in Chrome this year. Google patched other components like WebGL and V8 to enhance security. Users should update to the latest version to protect their devices.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Patch
- A software update from the maker that fixes a security weakness.
- Zero-day
- A weakness attackers use before the maker has released a fix.
- CVE
- A public ID number (like CVE-2026-12345) given to a known security weakness so everyone can talk about the same bug.
- Exploit
- Code or steps that take advantage of a weakness.
Key facts
| Reported by | SecurityWeek |
|---|---|
| Date reported | 10 Nov 2026 |
| CVE | CVE-2026-11645 |
| CVSS | 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Weakness | CWE-125 (out-of-bounds read), CWE-787 (out-of-bounds write) |
| CISA KEV | Yes, added 2026-06-09; federal due date 2026-06-23 |
| Ransomware use | Unknown (CISA KEV) |
| Vendor advisory | chromereleases.googleblog.com |
| CVE | CVE-2026-2441 |
| CVSS | 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Weakness | CWE-416 (use after free) |
| CISA KEV | Yes, added 2026-02-17; federal due date 2026-03-10 |
| Ransomware use | Unknown (CISA KEV) |
| CVE | CVE-2026-125350 (named by the sources; no NVD record yet) |
| Affected product | Google Chromium V8 |
| Published in NVD | 2026-06-09 (CVE-2026-11645) |
| Published in NVD | 2026-02-13 (CVE-2026-2441) |
How it works
A flaw in Chrome’s XML component (CVE-2026-125350) allowed attackers to exploit it. The vulnerability was reported on November 6 and patched in Chrome 157.
- Attacker reaches the Google Chromium V8 over the internet / network
- No login or account is needed
- A user must open a link or file first
- Sends crafted input that triggers the out-of-bounds read flaw
- Impact: data can be read, data or code can be changed, service crashes or stops
Skillmate analyst mapping (our judgement, not from the vendor):
- T1190 Exploit Public-Facing Application
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-02-13 | CVE-2026-2441 published in NVD | NVD |
| 2026-02-17 | CVE-2026-2441 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-03-10 | US federal agencies must patch by this date | CISA KEV |
| 2026-06-09 | CVE-2026-11645 added to CISA KEV (actively exploited) | CISA KEV |
| 2026-06-09 | CVE-2026-11645 published in NVD | NVD |
| 2026-06-23 | US federal agencies must patch by this date | CISA KEV |
| 2026-11-10 | Reported by SecurityWeek | SecurityWeek |
| 2026-11-10 | This Skillmate explainer published | Skillmate |
Am I affected?
These commands only read the version or settings. Compare the output with the vendor advisory linked in the facts table.
Google Chrome
shows the Chrome version:
chrome://settings/help (type in the address bar)How to fix it
- Update Google Chromium V8 to the fixed release named in the vendor advisory.
- Read the vendor advisory for CVE-2026-11645 and upgrade to the fixed release it lists.
- CVE-2026-11645 is in CISA KEV: treat it as actively exploited and patch first.
- CVE-2026-2441 is in CISA KEV: treat it as actively exploited and patch first.
- If you cannot patch today, limit who can reach the affected service and watch its logs.
How to detect it
Defenders can look for crashes, unusual logins, or logs indicating an XML component error.
What is confirmed and what is not
| Confirmed | Not confirmed yet |
|---|---|
| CVE-2026-11645 is a real NVD record scored 8.8 HIGH | NVD links no vendor advisory for CVE-2026-2441 yet |
| CISA lists CVE-2026-11645 as exploited in the wild | NVD has no record for CVE-2026-125350 yet |
| CVE-2026-2441 is a real NVD record scored 8.8 HIGH | |
| CISA lists CVE-2026-2441 as exploited in the wild | |
| Reported by SecurityWeek | |
| Reported by chromereleases.googleblog.com |
Why it matters
This matters because it highlights the ongoing threat of zero-day vulnerabilities. Companies and users need to keep their systems updated to protect against such attacks. For students, it underscores the importance of continuous learning and staying updated on cybersecurity.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What is a zero-day vulnerability?
A zero-day vulnerability is a security flaw that is unknown to the software vendor and can be exploited immediately.
How many zero-days have been patched in Chrome this year?
Chrome has patched eight zero-days this year.
What is CVE-2026-11645?
CVE-2026-11645 is a high-severity vulnerability in the V8 component of Chrome, allowing remote attackers to execute code.
Related Skillmate posts
Sources
- Chrome Update Patches Exploited XML Zero-Day, Eighth This Year (SecurityWeek)
- Vendor advisory CVE-2026-11645 (chromereleases.googleblog.com)
- Chrome (primary source) (chromereleases.googleblog.com)
- NVD CVE record (NVD)
How we wrote this: facts come from the sources above, NVD and CISA KEV. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.