Google releases emergency security updates to patch CVE-2026-11645, a high-severity Chrome zero-day that is actively exploited in the wild. Multiple outlets report this is the fifth Chrome zero-day patched since the start of the year. The vulnerability is tracked as CVE-2026-11645 and is associated with out-of-bounds memory access in V8, Chrome’s JavaScript and WebAssembly engine. Google’s security advisory states that an exploit for CVE-2026-11645 exists in the wild. According to reporting from Help Net Security and SecurityWeek, the issue is reported in late April by an anonymous researcher. Help Net Security also reports that Google ships the fix in Chrome 149.0.7827.102/.103 for Windows and macOS and Chrome 149.0.7827.102 for Linux. The update begins rolling out to users over the coming days and weeks. Across the sources, Google also addresses a total of 74 vulnerabilities in this release, with CVE-2026-11645 highlighted as the actively exploited zero-day.