Chrome's 5th Zero-Day of 2026 (CVE-2026-11645): Why Converting a File Beats Browsing to One

TL;DR

Google has patched CVE-2026-11645, a high-severity out-of-bounds read/write vulnerability in Chrome's V8 JavaScript engine, in Stable builds 149.0.7827.102/.103 (Windows/Mac) and 149.0.7827.102 (Linux). It's the fifth actively-exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. The bug lets an attacker run arbitrary code inside Chrome's sandbox via a specially crafted HTML page — a researcher reported it in late April 2026 and was paid a $55,000 bug bounty for it.

Update Chrome first. Nothing below is a substitute for patching — go to chrome://settings/help and let it update. This post is about a separate, second thing: if what you actually need to do is turn a file you already have (an image, a CSV export, a Markdown note) into a PDF, doing that with Convert: Anything to PDF never renders an untrusted web page at all — so this entire class of "crafted HTML page → code execution" bug, including CVE-2026-11645, isn't in the path. That's an architectural fact about the workflow, not a claim that the extension patches or blocks Chrome vulnerabilities.

What Is CVE-2026-11645?

CVE-2026-11645 is a high-severity out-of-bounds read/write vulnerability in V8, Chrome's JavaScript engine. Out-of-bounds read/write bugs happen when code accesses memory outside the bounds it's supposed to — which an attacker can abuse to leak memory contents, corrupt program state, or ultimately execute their own code.

Concretely: an attacker crafts an HTML page containing JavaScript designed to trigger the flaw. When your browser renders that page and runs its script, the bug lets the attacker execute arbitrary code inside the browser's sandbox. Google confirmed exploitation was already happening in the wild before the patch shipped, which is what qualifies it as a zero-day.

Key facts:

• CVE ID: CVE-2026-11645
• Component: V8 (Chrome's JavaScript engine)
• Bug class: Out-of-bounds read/write
• Severity: High
• Fixed in: Chrome 149.0.7827.102/.103 (Windows, Mac), 149.0.7827.102 (Linux)
• Attack vector: A specially crafted HTML page executed in the browser
• Reported: Late April 2026, by an anonymous researcher
• Bounty paid: $55,000
• Sequence: The fifth Chrome zero-day patched in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281

If your Chrome is behind 149.0.7827.102 (or .103 on Windows/Mac), you're exposed. Update now — see the walkthrough below.

Five Zero-Days, One Pattern

Line up all five of 2026's actively-exploited Chrome zero-days and a pattern jumps out immediately:

Different components — a renderer bug here, a WebGPU use-after-free there, a V8 out-of-bounds bug now — but the same shape every time: a malicious or compromised web page is rendered by your browser, and rendering (or running the script on) that page is what triggers the exploit. No page load, no exploit. That's true whether the vulnerable code lives in the DOM renderer, the GPU layer, or the JavaScript engine — V8 has to parse and execute whatever script the page ships, and a crafted page is exactly the delivery mechanism this bug class depends on.

This is a browsing-time risk. It requires your browser to fetch a URL, download that page's HTML and script, and execute it as untrusted code — which is what browsers are built to do for every site you visit. It's an inherent property of browsing the web, not a flaw specific to any one site. It's also precisely the property that a local file conversion workflow doesn't have.

Why Converting a Local File Is a Fundamentally Different Workflow Than Browsing to One

Here's the distinction that matters, stated plainly: browsing fetches and renders a remote page you don't control. Converting a local file processes something that's already sitting on your device — nothing gets fetched, and nothing gets rendered as a live web page.

Think about what actually happens in each case:

Browsing to a page (the exposed workflow):

1. Your browser sends a request to a URL.
2. A remote server — which could be compromised, or could simply be malicious by design — returns HTML, CSS, and JavaScript.
3. Chrome's rendering engine parses that HTML and DOM, and V8 executes the page's JavaScript.
4. If that content is a crafted exploit, this is the exact moment CVE-2026-11645 (or any of the other four 2026 zero-days) can trigger.

Converting a local file with Convert: Anything to PDF (the workflow that skips this):

1. You already have a file on your device — a JPG export, a CSV pulled from your accounting software, a Markdown note, a JSON log dump.
2. You drop it into the extension.
3. The extension reads the file's bytes locally and lays out a PDF from them using a bundled library (jsPDF) running in the extension's own context.
4. Nothing is fetched from a URL. No third-party HTML is parsed and rendered as a live page. No remote JavaScript executes.

The difference isn't that Convert: Anything to PDF has some special defense against V8 bugs — it doesn't, and no extension can patch the browser it runs inside. The difference is that the workflow itself never puts you in the situation the exploit needs. CVE-2026-11645 needs a crafted HTML page to be rendered and its script executed. Converting a CSV that's already on your hard drive doesn't render any page at all — there's no untrusted remote content in the loop to trigger the bug in the first place.

To be precise about the one case where this distinction gets blurry: Convert: Anything to PDF also supports converting the active web page you're currently viewing into a PDF. That workflow does involve a page you've already navigated to and that Chrome has already rendered — so the exposure there is identical to ordinary browsing, no better or worse. The attack-surface reduction this post is describing applies specifically to the local-file conversion path (images, text, Markdown, JSON, XML, CSV): a workflow that, by design, never fetches or renders anything from the web.

This is attack-surface reduction, not immunity. You should still update Chrome. But if part of your task was ever "I have a file, I need it as a PDF" rather than "I need to save a web page," doing the former locally is a lower-exposure way to get there.

A Practical Walkthrough: Converting Files Without Ever Touching a Browser Tab

Here's what the local-file conversion path actually looks like in Convert: Anything to PDF:

1. Click the extension icon, then choose "Upload Files" (as opposed to "This Page," which converts the active tab).
2. Drag and drop your file(s) into the drop zone. Supported local-file formats span images (JPEG/JPG, PNG, WebP, SVG, GIF, BMP), text and markup (TXT, HTML, Markdown, JSON, XML), and tabular data (CSV — Excel users export to CSV first, since .xlsx isn't read directly).
3. Pick paper size and orientation — A4, US Letter, US Legal, or Tabloid, portrait or landscape. Wide CSVs (6+ columns) auto-switch to landscape.
4. Click Convert. The PDF is generated on-device and downloads immediately — no upload, no progress spinner waiting on a server, no account to sign into first.

At no point in that flow does the extension issue a network request to fetch a page, and at no point does it hand a crafted piece of HTML to Chrome's rendering engine to display as a live site. It's reading bytes from a file already on your machine and writing bytes to a new PDF file, entirely inside the extension's own local execution context. You can also merge several files — say, three product photos, a spec sheet exported as Markdown, and a pricing CSV — into a single combined PDF in one pass, still without a single byte leaving your device.

Extension Security Checklist, Updated for a Fifth Zero-Day

The same checklist holds up after five zero-days as it did after four — worth restating:

Convert: Anything to PDF's local-file path checks every green box above: no account, no uploads, no data retention, because there's no server on the other end to retain anything. (For the fuller case on why "no upload" matters for a PDF tool specifically, see why a PDF converter shouldn't upload your files.)

How to Update Chrome (Do This Regardless)

Local-file conversion narrows one specific slice of exposure. It does not patch Chrome, and it does nothing for the "This Page" conversion mode, ordinary browsing, or any other tab you have open. Update now:

1. Open Chrome and click the three-dot menu (⋮) in the top right.
2. Go to Help → About Google Chrome.
3. Chrome checks for updates automatically and shows your current version.
4. If an update is available, it downloads and prompts you to relaunch.

You want 149.0.7827.102 or later (149.0.7827.103 on Windows/Mac) to be patched against CVE-2026-11645.

Frequently asked questions

Does Convert: Anything to PDF patch or block CVE-2026-11645?

No. No browser extension can patch a bug inside Chrome itself — that fix only comes from Google, in Chrome 149.0.7827.102/.103. What the extension's local-file conversion offers is different: a workflow that doesn't require fetching and rendering an untrusted web page in the first place, so the specific trigger this bug (and the other four 2026 zero-days) relies on never comes into play for that task.

If I convert my active browser tab, am I still exposed to this bug?

The "This Page" conversion mode works on a tab you've already navigated to and that Chrome has already rendered, so it carries the same exposure as ordinary browsing — no more, no less. The attack-surface argument in this post applies specifically to converting files that are already on your device (images, CSV, Markdown, JSON, and so on), which never involves rendering a remote page.

Is this the same vulnerability as the one in the April 2026 post about the 4th zero-day?

No — that post covered CVE-2026-5281, a use-after-free bug in Dawn (Chrome's WebGPU implementation), patched in April 2026. CVE-2026-11645 is a different bug in a different component (V8, the JavaScript engine), patched three months later in July 2026. They share the same broad pattern — a crafted HTML page triggering code execution — but they're distinct flaws with distinct patches. We also covered a related pair of extension-specific V8 flaws — CVE-2026-7940 and CVE-2026-7937 — back in May.

Why does converting a local file avoid this risk but browsing doesn't?

Browsing requires your browser to fetch a remote URL and execute whatever HTML and JavaScript that server returns — that's the exact mechanism CVE-2026-11645 depends on. Converting a local file skips all of that: the extension reads bytes from a file that's already on your device and writes a PDF, without ever issuing a request to a URL or handing untrusted HTML to Chrome's rendering engine.

Do I still need to update Chrome if I only use the local-file conversion mode?

Yes, always. Reducing your exposure on one specific task doesn't patch the browser. Every other tab, link, and site you browse still runs on whatever Chrome version you have installed, and CVE-2026-11645 (like the other four 2026 zero-days) can be triggered by any page you visit until you update.

Who found CVE-2026-11645, and was it exploited before the patch?

An anonymous researcher reported it in late April 2026 and received a $55,000 bug-bounty payout. Google classifies it as actively exploited in the wild, which is what makes it a zero-day rather than a routine bug fix.

Is Convert: Anything to PDF free, and does it require an account?

Yes to both — it's completely free, with no account, no watermarks, and no file-size limits. Conversion runs entirely on your device.

Bottom line

CVE-2026-11645 is Chrome's fifth actively-exploited zero-day of 2026, a high-severity out-of-bounds read/write bug in V8 fixed in Chrome 149.0.7827.102/.103. Update your browser — that's non-negotiable, and nothing about a file converter changes that.

But it's also the fifth reminder in a row that the risky moment is the same each time: a browser fetching and rendering a page it doesn't control. If your actual task is turning a file you already have into a PDF — not saving a web page — Convert: Anything to PDF does that locally, on-device, with nothing fetched and nothing uploaded. That's a narrower, more honest kind of safety than "immune to zero-days" — it's just a workflow that never puts a crafted web page in front of your browser to begin with.

Update Chrome. Then use the right tool for files you already have.