Exploitation Summary
CVE-2026-11645 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 9, 2026. EIP tracks 3 public exploits from researchers including 0xBlackash, adamshaikhma, fevar54.
AI-analyzed exploit summary The repository contains a functional HTML-based PoC for CVE-2026-11645, a V8 engine out-of-bounds read/write vulnerability in Chrome 148. The exploit triggers memory corruption via type confusion in JavaScript class manipulation, potentially leading to RCE.
Description
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Exploits (3)
The repository contains a functional HTML-based PoC for CVE-2026-11645, a V8 engine out-of-bounds read/write vulnerability in Chrome 148. The exploit triggers memory corruption via type confusion in JavaScript class manipulation, potentially leading to RCE.
The repository claims to provide an exploit for CVE-2026-11645 but lacks actual exploit code, instead directing users to an external download link (tinyurl.com). The README contains generic details about the vulnerability without technical depth or functional code.
This repository contains a functional proof-of-concept exploit for CVE-2026-11645, demonstrating an out-of-bounds read/write vulnerability in Chrome's V8 JavaScript engine. The exploit leverages JIT compilation to bypass bounds checks and includes both a detailed PoC and a minimalist trigger.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H