Google has released emergency updates for Chrome 149 to patch CVE-2026-11645, a high-severity zero-day vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. This marks the fifth Chrome zero-day patched since the start of 2026.
The vulnerability is an out-of-bounds read and write weakness in V8 that allows remote attackers to execute arbitrary code within the browser sandbox using crafted HTML pages. Successful exploitation enables heap corruption, exposure of sensitive data, and can bypass protection mechanisms like ASLR — making it easier to chain with other vulnerabilities for full code execution. Patched versions are rolling out now: Windows (149.0.7827.102), Mac (149.0.7827.103), and Linux (149.0.7827.102).
Google has withheld further details about the attacks exploiting CVE-2026-11645 until a majority of users have updated. The flaw was reported by an anonymous researcher. Chrome users should update immediately — the patch was available when checked today, though Google notes the rollout may take days for some users.
Source
BleepingComputer · SecurityWeek · Help Net Security
Commentary
Five Chrome zero-days in six months is a troubling pace, even for the world’s most popular browser. The V8 engine continues to be the most targeted component — three of the five 2026 zero-days have been V8-related. This underscores both the engine’s complexity and its value as an attack surface.
For enterprises, the takeaway is clear: Chrome’s automatic update mechanism is not fast enough for zero-days. Organizations should be pushing updates through their management tools the same day patches drop, not waiting for the natural rollout cycle. If you’re not monitoring Chrome versions across your fleet, you’re leaving a window open that attackers are already climbing through.