Google patches new Chrome zero-day flaw exploited in the wild
Google issued emergency Chrome updates for an actively exploited zero-day in the V8 engine. It is the fifth Chrome flaw patched after in-the-wild abuse this year.
Intelligence analysis by GPT-5.4 Mini
Google has pushed emergency Stable Desktop Chrome updates to fix CVE-2026-11645, a high-severity zero-day in V8 that attackers were already using. The bug can be triggered through crafted HTML and may help attackers read memory, crash the browser, or aid code execution.
Google found a hole in Chrome that bad actors were already using, like a weak spot in a wall they could poke through. It fixed the hole, but people still need to install the patch so the lock actually works.
Analysis
What happened
Google released emergency updates for Chrome Stable Desktop after confirming that CVE-2026-11645 was being exploited in the wild. The patched builds are rolling out for Windows, Mac, and Linux, and Google says the fix may take days or weeks to reach everyone automatically, although it was available when BleepingComputer checked.
What the flaw does
The vulnerability is described as an out-of-bounds read and write issue in Chrome's V8 JavaScript engine. In practical terms, a remote attacker can use a specially crafted HTML page to abuse the browser's memory handling. That can expose data beyond the intended memory buffer, crash the browser, or help bypass defenses such as ASLR, which can make later code execution easier.
Pattern this year
Google says this is the fifth Chrome zero-day patched since the start of 2026. The article lists earlier issues in CSSFontFeatureValuesMap, Skia, V8/WebAssembly, and Dawn, all of which were also reported as exploited attacks. Google also notes that it keeps bug details restricted until most users have updated, especially when third-party libraries are involved.
What to watch
The immediate action is to update Chrome rather than wait for the auto-update cycle. For security teams, the story reinforces that browser patch latency matters: a widely deployed browser can become an attack path very quickly once a public exploit is active.
Key points
- Google patched CVE-2026-11645, a Chrome zero-day that it says was exploited in the wild.
- The flaw affects the V8 JavaScript engine and can be triggered through crafted HTML pages.
- The issue may allow memory access beyond bounds, crashes, and help with bypassing protections like ASLR.
- This is the fifth Chrome zero-day Google has patched since the start of 2026.
- Google is rolling the fix out for Windows, Mac, and Linux Stable Desktop users.
Google pushed the fix quickly and started rolling it out across major desktop platforms. If users update promptly, the active exploit should lose much of its value and the window for abuse can shrink.
Chrome's automatic updates may take time to reach everyone, leaving a gap where some users remain exposed. Because the bug can be used from a crafted web page, attackers may keep targeting lagging systems until the patch is widely installed.
