Google Chrome Patches Actively Exploited V8 Zero-Day Vulnerability

Google has issued an urgent security update to address a high-severity zero-day vulnerability, identified as CVE-2026-11645, within its widely used Chrome browser. This critical flaw resides in the V8 JavaScript and WebAssembly engine, a core component responsible for executing code in Chrome. The vulnerability, described as an "out-of-bounds read and write" weakness, allows remote attackers to execute arbitrary code within the browser's sandbox by leveraging specially crafted HTML pages. This means that simply visiting a malicious webpage could be enough for an attacker to compromise a user's system, potentially leading to the exposure of sensitive information, system crashes, or even further malicious activities. The significance of this vulnerability is amplified by the fact that it has already been exploited in the wild. This means that malicious actors are actively using this flaw to target users before a fix was widely available. Google's security advisory explicitly states awareness of these exploits, underscoring the immediate need for users to update their browsers. This marks the fifth actively exploited zero-day vulnerability that Google has had to patch in Chrome in 2026 alone, highlighting a concerning trend of sophisticated attacks targeting widely used software. The patched versions of Google Chrome are rolling out globally for Windows (149.0.7827.102), Mac (149.0.7827.103), and Linux (149.0.7827.102). While Google's automatic update system will eventually deliver the patch to all users, it may take several days or weeks to reach everyone. Therefore, users are strongly advised to manually check for and install the latest Chrome update immediately to ensure their systems are protected. This can be done by navigating to Chrome's settings menu, typically found under the three-dot icon, and selecting 'About Chrome' to trigger the update check. The vulnerability (CVE-2026-11645) was reported by an anonymous security researcher on April 27, 2026, and was awarded a bug bounty of $55,000 for responsible disclosure. Google has, as is standard practice, restricted detailed information about the bug until a majority of users have updated their browsers, a measure designed to prevent further exploitation. This incident serves as a stark reminder of the constant threat posed by zero-day vulnerabilities, especially in widely adopted software like Google Chrome. The widespread use of Chrome across various platforms, including India where it holds a significant market share, makes such vulnerabilities a global concern. Users across all operating systems are urged to prioritize this update to safeguard their digital security against potential data breaches and system compromises. The potential impact of such vulnerabilities can range from unauthorized access to sensitive data and credentials to full system control, making timely patching a critical cybersecurity practice. Other recently patched zero-days in Chrome this year include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281, further emphasizing the continuous efforts required to maintain browser security.

Frequently Asked Questions

Read Full Story on Quick Digest