CERT-In flags active exploitation of a Chrome flaw

CERT-In issued a critical vulnerability note on 16 June warning that CVE-2026-11645 in Google Chrome was being actively exploited. The Indian security agency’s notice urged users to apply the latest patches immediately.

The affected desktop releases were versions before 149.0.7827.102/103 on Windows and macOS, and before 149.0.7827.102 on Linux. Those numbers identify the June remediation threshold in this advisory; they are not a recommendation to install an old build now.

The note covered multiple browser vulnerabilities across components including V8, GPU, networking and media. CERT-In described possible outcomes such as arbitrary code execution, sensitive information exposure, bypass of security restrictions and denial of service.

The active-exploitation statement specifically named CVE-2026-11645. It did not say every flaw in the update was being used in attacks. Nor did the notice identify an attacker, affected organisations or a victim total. Its target audience included both individual desktop users and organisations maintaining Chrome installations. The advisory links directly to Google’s release notice for remediation.