Chrome CVE-2026-11645 is now in CISA’s Known Exploited Vulnerabilities catalog. CISA added the issue on June 9, 2026, with a due date of June 23, 2026 for covered federal systems. Google’s Chrome Releases post says the Stable channel update includes 74 security fixes and that Google is aware an exploit for CVE-2026-11645 exists in the wild.
This matters beyond ordinary desktop patching. Admin workstations often stay signed in to WordPress dashboards, cPanel, WHM, Plesk, WHMCS, Proxmox, VMware, cloud consoles, DNS providers, email admin panels, backup systems, and customer support tools. A browser issue on one trusted machine can become an infrastructure problem if that machine has long-lived sessions and privileged access.
This is a protect-only guide. It gives the safe update and verification path without publishing exploit details, reproduction steps, request patterns, or bug tracker material that should stay restricted until users are patched.
What is affected
The official CVE record describes CVE-2026-11645 as an out-of-bounds read and write issue in V8 in Google Chrome before 149.0.7827.103. Google’s Chrome Releases post lists the fixed Stable channel update as 149.0.7827.102/.103 for Windows and Mac, and 149.0.7827.102 for Linux.
- Google Chrome Stable on Windows, macOS, and Linux before the fixed Stable build listed by Google.
- Chromium-based browsers that have not yet picked up the fixed Chromium code from their own vendors.
- Managed browsers on admin workstations, helpdesk machines, accounting systems, developer laptops, and jump boxes.
- Browsers with stale sessions into hosting panels, WordPress admin, password managers, remote consoles, billing systems, cloud dashboards, or customer environments.
What to do now
- Update Google Chrome immediately. Use the built-in updater, software management, RMM, MDM, package manager, or enterprise browser management path you already trust.
- Restart the browser. Chrome updates are not complete while old browser processes, helper processes, or background sessions are still running.
- Verify the version. On Chrome, check chrome://settings/help and confirm the browser has reached the fixed Stable channel build from Google or newer.
- Patch other Chromium-based browsers separately. Microsoft Edge, Brave, Vivaldi, Opera, Electron apps, embedded browsers, and Linux Chromium packages may have their own release timing. Do not assume they are fixed just because Chrome updated.
- Prioritize admin machines. Patch devices used for WordPress, cPanel, WHM, Plesk, WHMCS, Proxmox, VMware, DNS, CDN, mail, backup, cloud, and password-manager administration first.
- Check managed fleet status. In Intune, RMM, MDM, Google Admin, Jamf, Munki, Linux package reporting, or your endpoint tool, look for browsers that are still below the fixed build after policy sync.
- Review risky browsing sessions. If a privileged admin machine was behind on Chrome and browsed untrusted sites, ads, email links, or customer-submitted URLs, review recent sign-ins, browser extensions, endpoint alerts, and session activity.
Hosting and agency notes
For web hosts and agencies, the fastest win is to patch the machines that touch customer environments. That includes support technicians, developers, billing staff, and owners who keep admin tabs open all day. Browser patching should sit next to password-manager health, MFA enforcement, and device compliance in the same checklist.
If a workstation had open sessions into customer sites or hosting tools while it was behind on Chrome updates, do not panic, but do be practical. Check for unusual account logins, new browser extensions, endpoint security alerts, unexpected customer-site admin actions, odd WHM/cPanel activity, suspicious DNS changes, and cloud-console events. Rotate sessions or credentials when the risk story supports it.
Post-update verification checklist
- Chrome reports the fixed Stable channel build from Google or newer on Windows, macOS, and Linux devices.
- Browsers have been fully restarted, not just downloaded in the background.
- Managed browser dashboards or RMM reports show no stale Chrome installs on admin devices.
- Other Chromium-based browsers have been checked against their own vendor update pages.
- Privileged admin sessions into hosting panels, WordPress, cloud, DNS, backups, billing, and remote consoles have been reviewed where exposure was plausible.
- Browser extensions, endpoint alerts, and recent sign-in activity look normal on machines that were behind.
- Staff know to relaunch Chrome when the update button appears, especially on machines used for customer support or infrastructure administration.
Related Fix I.T. Phill reading
- MiniPlasma Windows zero-day admin checklist
- Check Point CVE-2026-50751 VPN patch guide
- LiteLLM CVE-2026-42271 AI gateway patch guide
- How to plan a WordPress update window without breaking the site
- How to check backups and restore points
Sources
- CISA Known Exploited Vulnerabilities catalog
- Google Chrome Releases: Stable Channel Update for Desktop
- NVD entry for CVE-2026-11645
- Official CVE API record for CVE-2026-11645
Need help finding stale browsers on admin machines before they become a bigger problem? Fix I.T. Phill can help check the fleet, patch the risky devices, and verify the accounts and tools those browsers can reach.
