8.8 CVSS. Not the problem.
Chrome's V8 engine is under attack via CVE-2026-11645, a zero-day vulnerability with a CVSS score of 8.8, allowing remote attackers to execute arbitrary code. The vulnerability is described as an out-of-bounds memory access in V8.
The issue isn't the vulnerability itself, but the window of exploitation. 42% of exploited vulnerabilities in 2025 were weaponized before public disclosure, according to the CrowdStrike Global Threat Report 2026. This pattern exposes a systemic failure in patch governance.
The defensive math: -> Prioritize Chrome patching to version 149.0.7827.103 or later, to mitigate the risk of this high-severity vulnerability -> Review incident response plans for potential exploitation of zero-day vulnerabilities, focusing on detection telemetry -> Implement a 14-day patch cycle for high-severity vulnerabilities, given the 187-day patch-to-exploit median, as per IBM Cost of a Data Breach Report 2025
What is the average patch-to-exploit time for high-severity vulnerabilities in your organization?