Exploiting CVE-2026-11645: Google Chromium V8 Vulnerability in Phishing Campaigns

Exploring the intersection of phishing campaigns and critical vulnerabilities can unearth powerful strategies for attackers. One such vulnerability is CVE-2026-11645, a Google Chromium V8 out-of-bounds read and write vulnerability. Understanding its exploitation in phishing scenarios reveals how crafted HTML pages can execute arbitrary code, impacting not only Google Chrome but other Chromium-based browsers like Microsoft Edge.

Campaign or TTP Overview

In early 2026, a sophisticated phishing campaign was identified targeting financial institutions in North America and Europe. This campaign leveraged the CVE-2026-11645 vulnerability to infiltrate systems. The attackers executed a zero-day exploit within a crafted HTML email attachment, allowing them to execute arbitrary code with the privileges of the user who opened the file.

Attributed to a threat group known as “Silver Falcon”, the campaign saw the first stirrings in January 2026. Reports suggest the group targeted mid to high-level executives in these institutions, aiming to gain control over sensitive financial data. By masquerading as internal policy updates from well-known software providers, they persuaded many targets to engage with the malicious content, thus initiating the payload execution pathway.

For information on exploited vulnerabilities, including this case, refer to the CISA Known Exploited Vulnerabilities Catalog.

How It Was Built

The campaign’s success hinged on the meticulous construction of both the phishing email and the embedded payload. The infrastructure capitalized on compromised domains, primarily those that had been unused or recently expired, thus bypassing many threat detection mechanisms reliant on domain age metrics.

Delivery was primarily through spear-phishing emails with subject lines such as “Important Security Update – Action Required” and “Urgent: Compliance Directive for [Target Name]”. These emails spoofed sender IDs which mimicked those from trusted software vendors, further enhancing the credibility of the communication.


From: security-updates@trusted-vendor.com

To: executive.name@target-organization.com

Subject: Important Security Update - Action Required

Attachment: security_update_policy.html

The attached HTML file, once opened in a vulnerable Chromium-based browser, would exploit the V8 vulnerability to gain access to the host system. This exploit allowed the attackers to execute shell commands, ultimately downloading additional payloads to maintain persistence and exfiltrate data.

Why It Worked

Several deliberate choices contributed to the campaign’s effectiveness:

Sender Legitimacy: By using spoofed identities from trusted vendors, the attackers positioned their emails to bypass suspicion by leveraging pre-established trust.
Subject Line Urgency: The urgency conveyed in subject lines nudged targets towards immediate action, clouding their judgment and preventing their skepticism.
Domain Reputation: Using compromised domains that bore a semblance of legitimacy helped in navigating past domain reputation checks typically enforced by corporate security solutions.

Each element worked symbiotically, crafting a potent delivery mechanism that compelled users to engage with the email’s content and proceed to execute the malicious payload, which was seamlessly executed due to the V8 vulnerability.

The essence of attack success lies in the seamless integration of vulnerability exploitation within credible communication.

Operator Takeaways

For red team engagements, the tactics seen in the Silver Falcon campaign offer rich insights:

Replicate sender and domain spoofing efforts to evaluate organizational protections against well-crafted, seemingly legitimate email origins.
Employ urgent and relevant subject lines that align with the victim’s industry to maximize engagement and prompt interaction with phishing content.
Utilize vulnerabilities like CVE-2026-11645 to test the responses to zero-day exploitation within your scope.

These schematics can serve as a blueprint for authorized engagements to highlight systemic weak points in digital communication and patch management strategies.

Do’s and Don’ts

Do use authentic-looking domains and sender emails to enhance credibility.
Do construct lure content that is industry-specific and uses timely references.
Don’t rely solely on technical exploits; ensure your campaign is equally strong in social engineering tactics.
Don’t foreshadow the payload delivery with overtly technical language that could raise suspicion among more savvy users.