Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now

Security professionals worldwide are on high alert following Google's disclosure of a critical Chrome vulnerability actively being exploited by threat actors. The technology giant has released emergency patches addressing 74 security flaws in its popular browser, with one zero-day vulnerability already leveraged in real-world attacks before a fix was available.

CVE-2026-11645 has been identified as a high-severity issue in Chrome's V8 engine, which serves as the foundation for JavaScript and WebAssembly processing. The vulnerability stems from an out-of-bounds memory access weakness that could potentially allow attackers to execute unauthorized code or cause system crashes. With a CVSS score of 8.8, this vulnerability presents significant risk to organizations and individuals alike. All Chrome versions prior to 149.0.7827.103 are vulnerable to this specific flaw.

While technical details about the exploitation methods remain limited to prevent further abuse, security researchers note that the vulnerability allows for both out-of-bounds read and write operations in V8's memory. This type of flaw is particularly concerning as it could enable attackers to bypass security controls, extract sensitive information, or potentially gain control over affected systems when combined with other exploit techniques.

For security teams, this discovery underscores the critical importance of prompt patching and robust vulnerability management. The active exploitation status means that organizations cannot afford delayed updates in this instance. Security professionals should immediately verify that all Chrome installations across their environments have been updated to the latest patched version. Additionally, organizations should consider implementing temporary mitigations such as restricting browser permissions where possible and enhancing monitoring for suspicious activities until complete patching can be verified. This incident also highlights the value of defense-in-depth strategies, as browser-level protections alone may prove insufficient against determined threat actors.

Key takeaways from this incident include the