Google Chrome Patches Actively Exploited Vulnerability CVE-2026-11645

Google has issued an urgent update for its widely-used Chrome browser, addressing a critical security vulnerability identified as CVE-2026-11645. This flaw has reportedly been actively exploited by malicious actors, raising immediate concerns for users worldwide.

The vulnerability allows for remote attackers to execute arbitrary code within the browser's sandbox environment. This means that a threat actor could potentially compromise a user's system by tricking them into visiting a specially crafted HTML page. Once executed, the malicious code could perform a wide range of actions, from stealing sensitive data to installing further malware, depending on the attacker's objectives.

The sandbox mechanism in modern browsers is designed to isolate web content and prevent malicious code from accessing the underlying operating system or other sensitive user data. However, a vulnerability like CVE-2026-11645 bypasses these protections, granting attackers a significant foothold.

While the specifics of the exploit chain are not yet fully detailed, the nature of the vulnerability suggests it could be delivered through various means, including malicious advertisements, compromised websites, or phishing emails containing links to specially designed web pages.

Google has not disclosed the exact version of Chrome affected or the specific threat actors behind the observed exploitation. However, the company's swift release of a patch indicates the severity and immediate threat posed by this vulnerability. Users are strongly advised to update their Chrome browsers to the latest version as soon as possible to mitigate the risk.

The company typically addresses such vulnerabilities through its regular security update cycles, but the "actively exploited" tag signifies a heightened risk that necessitates immediate user action. This incident underscores the ongoing cat-and-mouse game between browser vendors and malicious actors, highlighting the importance of timely patching and robust security practices.

This event serves as a stark reminder that even seemingly ubiquitous software like web browsers can harbor critical flaws that are targeted by attackers. Staying vigilant and ensuring all software is kept up-to-date remains a cornerstone of effective cybersecurity hygiene for both individuals and organizations.

This new report from Help Net Security confirms the details of CVE-2026-11645, a high-severity zero-day vulnerability in Google Chrome that has been exploited in the wild. The article specifies that the vulnerability is an out-of-bounds issue and that Google has released Chrome 149.0.7827.102/.103 for Windows, macOS, and Linux to address it, with the update rolling out gradually.

This update from Malwarebytes Labs provides additional context on the actively exploited CVE-2026-11645 vulnerability in Google Chrome's V8 JavaScript engine. It details how the out-of-bounds read/write flaw can be triggered by a crafted HTML page, allowing remote attackers to execute arbitrary code within the browser's sandbox. The article also highlights the importance of manual updates if automatic updates are not functioning correctly.

This latest report confirms that CVE-2026-11645 is the fifth actively exploited zero-day vulnerability to affect Google Chrome in 2026, a rate that places it on track to surpass the number of zero-days patched in the previous year. The vulnerability, an out-of-bounds memory access bug within the V8 JavaScript engine, was reported by a researcher who received a $55,000 bounty from Google, indicating its perceived severity. While Google has not disclosed specific technical details to prevent further exploitation, the patch is available for Windows, macOS, and Linux versions of the browser.

The vulnerability, CVE-2026-11645, is an out-of-bounds read and write in Chrome's V8 JavaScript engine, allowing remote attackers to execute arbitrary code within a sandbox via a crafted HTML page. A security researcher identified as "303f06e3" was credited with discovering the flaw and received a $55,000 bug bounty. This marks the fifth actively exploited Chrome zero-day this year, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.