---
id: 2120
title: "CVE-2026-11645: Out-of-Bounds Read/Write in V8."
cve: CVE-2026-11645
cvss: 8.8
severity: high
source_domain: bugpwn.com
source_url: "https://bugpwn.com/blog/cve-2026-11645.html"
published_at: "2026-06-08 00:00"
tags: ["active-exploitation", "rce", "zero-day", "browser-security", "exploitation", "v8", "chrome", "exploit-chain", "cve-2026-11645", "out-of-bounds", "browser-exploitation", "turbofan"]
phying_url: "https://phying.com/item/2120"
lang: en
---

# CVE-2026-11645: Out-of-Bounds Read/Write in V8.

## Summary

Deep dive into CVE-2026-11645, a Chrome V8 out-of-bounds read/write zero-day exploited in the wild and fixed in Chrome 149.0.7827.103, covering TurboFan OOB mechanics and addrof/fakeobj chains.

## Intelligence Metadata

- **Sources:** bugpwn.com
- **CVE:** CVE-2026-11645
- **CVSS:** 8.8
- **Published:** 2026-06-08 00:00
- **Original:** https://bugpwn.com/blog/cve-2026-11645.html
- **Phying News:** https://phying.com/item/2120