Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now

Summary: Google released security updates covering 74 vulnerabilities, including CVE-2026-11645, a high-severity (CVSS 8.8) out-of-bounds read and write in Chrome's V8 engine that allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Google confirmed an exploit for the flaw exists in the wild, credited researcher "303f06e3" with reporting it on April 27, 2026 and paying a $55,000 bounty, and noted this is the fifth actively exploited Chrome zero-day since the start of the year, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.
Why it matters: This is the fifth Chrome zero-day exploited in the wild this year, and the fix requires users on Windows, macOS, and Linux to reach version 149.0.7827.102/.103 - a version number most of your fleet will not hit on its own.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-11645 CVE-2026-2441 CVE-2026-3909 CVE-2026-3910 CVE-2026-5281
Related: ⚡ Weekly Recap: Chrome 0-Day, Uni Fi Exploits, macOS Stealers, VPN Flaw and More Cyber Risks ·
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day Cyber Risks ·
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox Cyber Risks ·