• Google patches high‑severity Chrome V8 bug (CVE‑2026‑11645) exploited in the wild
• Flaw allows remote code execution via crafted HTML on versions before 149.0.7827.103
• Fixes now live for Windows, Mac, and Linux; users urged to update immediately

Google has fixed a high-severity vulnerability in its Chrome browser that was apparently being abused in the wild.

The company has released a new security advisory informing users about fixing dozens of flaws, including an out of bounds read and write bug in Chrome V8 which could allow remote attackers to execute arbitrary code inside a sandbox via a crafted HTML page, was found in Google Chrome prior to 149.0.7827.103.

The issue is now tracked as CVE-2026-11645 and was given a severity score of 8.8/10 (high).

No details about the attacks

In theory, the flaw could be used to steal corporate emails, documents, session cookies, or other sensitive information. All it would take is a person opening a weaponized page in a vulnerable version of Chrome to trigger the exploit.

“Google is aware that an exploit for CVE-2026-11645 exists in the wild,” Google said in the advisory, without sharing any details. "Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the company added. "We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on but haven't yet fixed."

The bug has now been addressed in the Stable Desktop channel with patches being released for Windows (149.0.7827.102), Mac (149.0.7827.103), and Linux (149.0.7827.102).

Google usually says that it takes weeks for the patch to roll out globally but in most cases, by the time the advisory is published, most browsers will have been patched already. Those who are unsure if their Chrome is updated should navigate to chrome://settings/help in the address bar, press Enter and wait while Chrome checks for updates. If any are found, they will be prompted to download and install.

Via BleepingComputer

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.