The CVE-2026-11645 vulnerability in Google Chrome’s V8 JavaScript engine was caused by an inconsistent transition of an object’s Map. In V8, the Map acts as an object’s hidden class and represents how its properties are organized. This inconsistency in the transition can lead to out-of-bounds reads and writes in the object’s memory, enabling remote code execution.

It was reported by 303f06e3 on April 27, 2026, and Google later confirmed that it had been exploited in the wild. The vulnerability was fixed in Chrome 149.0.7827.102/.103 on June 8, 2026.

The issue occurred during a fast Map transition through the TryFastAddDataProperty function declared in the js-objects.cc file. When adding fields to a JavaScript class that extends Function, Map::PrepareForDataProperty could normalize the Map and return a slow dictionary map, but V8 would continue migrating the object as if the fast transition were still valid. That inconsistent state would ultimately result in a type confusion.

The fix checks whether Map::PrepareForDataProperty has returned a dictionary map. If so, it aborts the fast transition and falls back to the standard property addition path.

CVE-2026-11645

The PoC combines several particularly interesting elements:

• A JavaScript class that extends the Function object.
• Its value is changed at runtime.
• There is a Map transition: the initial property value is SMI while the final value is double.
• Dynamic creation of an anonymous function whose body runs in strict mode.
• It does not require V8 runtime flags.

The relevant V8 functions are:

• JSObject::CreateDataProperty
• TryFastAddDataProperty

In the following video, we show how we generated a Mutation Plan for the CVE-2026-11645 PoC, using the relevant elements described in the previous section as a reference.

The starting point is the JavaScript PoC file itself. From there, SeekZero allows us to configure the behavior of the mutator. For example, we can lock specific AST nodes to prevent mutations from being applied to them, or preserve them to prevent replacement or deletion mutations from affecting structures that we believe are interesting to keep.

We can configure the members and mutations of each node independently. This allows us to preserve the structure required to reach the behavior we want to investigate while, at the same time, introducing controlled variations around the code.

The Mutation Plan also allows us to define which internal V8 functions must be executed by the generated samples. If a mutation changes the program in a way that causes any of those functions to no longer be executed, the mutation is considered invalid and is reverted.

The decision of which nodes to lock or preserve and which mutations to allow is based on the interesting elements identified in the PoC. For example, we can preserve the Function inheritance and the creation of the function in strict mode, while allowing controlled mutations on the SMI-to-double transition and adding new elements to the class body.

• https://issues.chromium.org/issues/506689381
• https://chromium-review.googlesource.com/c/v8/v8/+/7807043
• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html
• https://v8.dev/docs/hidden-classes
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Classes
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function