Google patches Chrome zero-day exploited in the wild

Google has issued an urgent security update for its Chrome browser to address a high-severity vulnerability that is already being actively exploited. The flaw, tracked as CVE-2026-11645, is an out-of-bounds memory access issue in the V8 JavaScript engine. It could allow attackers to execute arbitrary code on a victim's device by tricking them into visiting a maliciously crafted webpage.

The update, part of Chrome version 149.0.7827.102/.103 for Windows and macOS and version 149.0.7827.102 for Linux, began rolling out to users on or around June 8. Google confirmed in its advisory that an exploit for this vulnerability exists in the wild, though it has withheld technical details to prevent further exploitation while users update. The company credited an anonymous researcher who reported the flaw on April 27 and awarded them a $55,000 bug bounty.

This marks the fifth zero-day vulnerability in Chrome that attackers have exploited before a patch was available in 2026. The fix is included in a broader security release that addresses a total of 74 vulnerabilities, including 17 rated as critical and 55 as high-severity. Many of these are memory corruption flaws, such as use-after-free...