Google patches Chrome zero-day CVE-2026-11645 exploited in the wild
Chrome
Google
TLDR: MOUNTAIN VIEW—Google released emergency Chrome updates for CVE-2026-11645, a high severity V8 zero-day already exploited in the wild. Windows, Mac, and Linux Stable Desktop builds were updated, though rollout may lag.
Key Takeaways:
- Google is patching a fifth Chrome zero-day exploited in attacks since the year began, underscoring how fast weaponized browser bugs move.
- Google said it is aware an exploit exists for CVE-2026-11645 and patched Stable Desktop, with fixes reaching Windows 149.0.7827.102, Mac 149.0.7827.103, Linux 149.0.7827.102.
- Because V8 out of bounds reads and writes can enable heap corruption, attackers may steal data or crash Chrome, and may even weaken defenses like ASLR.
- Google plans to keep bug details restricted until most users update, and may restrict fixes tied to third party libraries that other projects still rely on.
This is the kind of browser patch cycle that feels nonstop, because one exploit in the wild turns every delay into a window for opportunistic attacks. The good news is automatic updates help, but the real win is letting Chrome finish updating everywhere, not just on your main device. 🔐
This is the kind of browser patch cycle that feels nonstop, because one exploit in the wild turns every delay into a window for opportunistic attacks. The good news is automatic updates help, but the real win is letting Chrome finish updating everywhere, not just on your main device. 🔐
Q&A
Why does fixing a V8 engine bug still leave businesses exposed for days or weeks?
Because enterprise fleets often lag behind consumer rollouts. Attackers only need one unpatched Chrome profile running to trigger a targeted drive by or phishing link.
What does restricted bug detail suggest about attacker tradecraft and Google TAG investigations?
It signals Google may be tracking ongoing campaigns and prefers to prevent defenders and attackers from comparing notes on exploit primitives before most endpoints update.
How could this bug interact with existing browser hardening like ASLR to increase impact?
An out of bounds memory flaw can pair with another weakness or technique to bypass or erode randomization assumptions, making successful code execution more repeatable.
Why does a report from an anonymous researcher still end with a public emergency patch?
When exploitation appears in the wild, the timing flips. Even partial internal understanding becomes less important than removing the vulnerable code path quickly.
If Google patched five actively used zero days this year, what should security teams change in their patch strategy?
Treat browser updates like operating system updates: monitor rollout status, verify versions at endpoints, and prioritize remediation windows so users do not become the last holdouts.
No comments yet. Be the first to share your thoughts!