Google releases emergency security updates to address CVE-2026-11645, a high-severity Chrome vulnerability that is actively exploited in the wild. Multiple outlets report the flaw is the fifth Chrome zero-day patched in 2026 so far. The vulnerability is reported to stem from improper input validation or an out-of-bounds memory access in V8, Chrome’s JavaScript and WebAssembly engine. According to coverage, a crafted HTML page can trigger the issue and lead to arbitrary code execution, including within Chrome’s sandbox context.
Google’s advisory states that an exploit for CVE-2026-11645 exists in the wild. Help Net Security and others report the fix ships in Chrome 149.0.7827.102/.103, with availability for Windows, macOS, and Linux. The update rolls out to users over the coming days and weeks. One outlet also notes the update includes fixes for dozens of other vulnerabilities, with 74 vulnerabilities mentioned across the broader security release. Overall, sources align on the vulnerability identifier, its in-the-wild exploitation, the type of technical impact, and the patched Chrome version range.
