PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-11645: Out-of-Bounds Read/Write in V8.

bugpwn.com | vulnerability | High | Actively exploited | CVE-2026-11645 | #active-exploitation | #rce | #zero-day | #browser-security | #exploitation | #v8 | #chrome | #exploit-chain | #cve-2026-11645 | #out-of-bounds | #browser-exploitation | #turbofan
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Deep dive into CVE-2026-11645, a Chrome V8 out-of-bounds read/write zero-day exploited in the wild and fixed in Chrome 149.0.7827.103, covering TurboFan OOB mechanics and addrof/fakeobj chains.
CVE
CVE-2026-11645
CVSS
8.8
Published
Collected

Related coverage

High · vulnerability · nebusec.ai
Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
NebuSec details CVE-2026-6307 (Longinus): a single V8 TurboFan bug yields arbitrary read/write in the heap sandbox and escapes it to write outside, piercing Chrome's renderer.
High · vulnerability · nebusec.ai
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
NebuSec explains CVE-2026-5865: an omitted write barrier in V8's Maglev compiler lets the garbage collector miss an object, yielding fakeobj and RCE against Chrome.
research · nebusec.ai
Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon
This research reveals deep compiler-level optimization pitfalls in modern JIT/WASM engines that lead to renderer sandbox escapes.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Medium · vulnerability · pwn.ai
CVE-2026-14077: Select Your Own Origin - Spoofing Chrome's Address Bar
pwn.ai's CVE-2026-14077: an HTML select positioned partly above the viewport let a page draw native UI over Chrome's toolbar, spoofing the omnibox for a convincing fake download flow.
research · portswigger.net
Abusing Chrome's XSS auditor to steal tokens
Gareth Heyes abuses Chrome's XSS Auditor block mode as a side-channel oracle, brute-forcing values such as user IDs embedded in inline scripts and stealing tokens. Includes working PoC code.
Back