Google Updates Chrome: Fifth Zero-Day Vulnerability of 2026 Closed

Google has released an emergency update for its Chrome browser, resolving a serious zero-day vulnerability that has already been actively exploited in the wild. Identified as CVE-2026-11645, this is the fifth security flaw of this kind that the company has had to mitigate since the beginning of the year, confirming a concerning trend in the cybersecurity landscape that directly targets web browsers.

The criticality lies in an out-of-bounds read and write weakness located in Chrome's JavaScript engine, V8. Through specially crafted HTML pages, a remote attacker can exploit this flaw to execute arbitrary code within the browser's sandbox. The consequences are far from negligible: an effective compromise indeed opens the door to unauthorized access to data beyond the limits of memory buffer, through heap corruption phenomena. This can translate into exposure of sensitive information or sudden system crashes. The threat also manifests in its ability to bypass protection mechanisms like ASLR (Address Space Layout Randomization), facilitating further attacks for code execution.

Google has promptly distributed the update for users on the Stable Desktop channel, affecting versions 149.0.7827.102 for Windows and Linux, and 149.0.7827.103 for Mac. The patch was released two weeks after the reporting by an anonymous security researcher. Although Google has communicated that the rollout of the update may take days or weeks to reach all users, it can be applied immediately through manual installation.

The company has chosen to keep details specific to the exploits that leveraged CVE-2026-11645 under wraps. This policy of limiting access to information is aimed at ensuring most users have time to install the fix before further details can be used to launch new attacks. A necessary measure to minimize critical phenomena for the global user base, but one that limits full transparency on incidents.

This fifth vulnerability follows a series of other critical defects resolved by Google in 2026, highlighting a constant race to remediate actively exploited vulnerabilities. Already by mid-February, Google had patched CVE-2026-2441, a bug in iterator invalidation in CSSFontFeatureValuesMap. In March, two more zero-days were resolved: CVE-2026-3909, an out-of-bounds write weakness in the 2D graphics library Skia, and CVE-2026-3910, an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine. Finally, in April, it was the turn of CVE-2026-5281, a use-after-free weakness in Dawn, the cross-platform implementation of the WebGPU standard used by the Chromium project.

Browser security remains a constant priority. Last year, Google patched eight zero-days exploited in the wild, many of which were reported by its Threat Analysis Group (TAG), a high-profile unit specialized in identifying and tracking zero-day exploits used in spyware attacks.