A critical Chrome security update vulnerability is actively being exploited in the wild — and if you haven’t updated your browser yet, you’re at risk right now. Google has released Chrome 149.0.7827.103, patching CVE-2026-11645, a high-severity zero-day flaw that can allow attackers to run malicious code on your device simply by visiting a crafted webpage.
What Is the Chrome Zero-Day CVE-2026-11645?
The Chrome zero-day CVE-2026-11645 is an out-of-bounds read and write vulnerability residing in V8, Chrome’s built-in JavaScript and WebAssembly engine. With a CVSS score of 8.8 — rated high severity — the flaw allows an attacker to perform memory operations beyond the boundaries of an allocated buffer. In practice, this means a threat actor could craft a malicious HTML page that, when loaded in an unpatched Chrome browser, triggers the bug and executes arbitrary code on the victim’s machine.
The term “zero-day” means the vulnerability was already being exploited in real-world attacks before Google was able to ship a fix. A security researcher who discovered and responsibly disclosed the flaw was awarded a $55,000 bug bounty — a figure that reflects just how serious Google considers the issue.
Google has confirmed it will not publish full technical details of the vulnerability until the majority of users have installed the patch. This is standard practice: releasing specifics too early would hand attackers a detailed roadmap before most people are protected.
Why You Need to Update Chrome Now
Active exploitation is the key phrase here. This isn’t a theoretical risk sitting in a lab — the Chrome update now advisory exists because real attackers are already using this technique. The attack vector is particularly dangerous because it requires no special privileges and no user interaction beyond opening a malicious page. Drive-by downloads, malvertising campaigns, and phishing links are all viable delivery mechanisms.
-
Arbitrary code execution: Attackers can run any code they choose on your device, potentially installing malware, ransomware, or spyware.
-
No warning signs: The exploit can fire silently — you won’t see a pop-up or an error message.
-
Broad target surface: Chrome holds roughly 78% of the global browser market, making it one of the most valuable targets for cybercriminals.
-
Chromium-based browsers also at risk: Microsoft Edge, Brave, Opera, and Arc all share the same underlying Chromium engine and are similarly exposed until they push their own updates.
How to Update Chrome and Fix the Vulnerability
Updating Chrome to the patched version — 149.0.7827.103 — takes under a minute. Follow these steps:
-
Open Google Chrome on your desktop.
-
Click the three-dot menu (⋮) in the top-right corner.
-
Go to Help → About Google Chrome.
-
Chrome will automatically check for and download the latest update.
-
Click Relaunch when prompted to finish installing the update.
After relaunching, return to the About page and confirm the version reads 149.0.7827.103 or higher. If you’re on a managed corporate device, contact your IT administrator — group policy may control update deployment.
For users of Chromium-based browsers, check for updates in each browser’s own settings menu. Edge users on Windows can also update through Windows Update.
Chrome Security Update: 74 Vulnerabilities Fixed in One Release
While the Chrome security update vulnerability CVE-2026-11645 is grabbing the headlines, the Chrome 149.0.7827.103 release is notably broad in scope. Google patched a total of 74 security vulnerabilities in this single update, ranging from low-severity issues to the critical zero-day. This makes it one of the more substantial security patches Chrome has shipped in recent memory, and underlines why keeping the browser up to date is a non-negotiable part of personal and business cybersecurity hygiene.
Among the other issues addressed are use-after-free bugs, type confusion errors, and various memory safety flaws across different browser components. None of the other 73 flaws are known to be actively exploited at the time of writing, but that can change rapidly once a patch is public and researchers begin reverse-engineering the fixes.
The Fifth Chrome Zero-Day Exploited in 2026
CVE-2026-11645 is the fifth actively exploited zero-day vulnerability Google has had to patch in Chrome in 2026 alone, according to BleepingComputer’s analysis. That’s a striking figure — and one worth putting in context.
Zero-days in major browsers are discovered every year, but the pace in 2026 highlights the intensifying cat-and-mouse game between Google’s security teams and sophisticated threat actors. Each previous zero-day in 2026 was also addressed via emergency out-of-band updates, demonstrating that Google is moving quickly when exploitation is confirmed — but also that attackers are probing Chrome’s codebase continuously and finding results.
The V8 JavaScript engine has been a recurring source of critical vulnerabilities. Because V8 processes untrusted code from every website a user visits, it sits directly in the attack path and is a prime target for memory-corruption exploits like out-of-bounds read/write bugs.
Chrome’s Dominance Makes Every Zero-Day High Stakes
Chrome’s market share stands at approximately 78% globally — the highest the browser has ever achieved. For context, its nearest rival, Microsoft Edge, accounts for less than 10% of browser usage. That dominance means a single unpatched Chrome zero-day can theoretically expose the majority of desktop internet users simultaneously.
This scale is precisely why nation-state actors and organised cybercriminal groups invest heavily in discovering Chrome vulnerabilities. A working exploit for a zero-day like CVE-2026-11645 can command enormous sums on the dark web — far more than the $55,000 bug bounty Google paid for the responsible disclosure.
Gemini Nano and Chrome’s Expanding Attack Surface
Alongside the security news, it’s worth noting that Chrome has been quietly expanding its capabilities in ways that also expand its attack surface. Recent versions have begun silently downloading a 4 GB on-device AI model called Gemini Nano, which powers Chrome’s neural network features. While the model itself does not introduce the CVE-2026-11645 flaw, the trend of embedding more complex, resource-heavy components into the browser means there are simply more code paths that could harbour future vulnerabilities.
This is not an argument against AI features — but it is a reminder that a browser is no longer just an HTML renderer. It’s a complex application platform, and keeping it updated is as important as keeping your operating system patched.
Protect Your Whole System, Not Just Your Browser
Patching Chrome is the immediate priority, but browser-based attacks are just one vector. A layered security posture means combining a current browser with reliable antivirus software and a well-maintained operating system. If your Windows installation is out of date or you’re running without active threat protection, a compromised browser could be the entry point for a far wider system compromise.
Running Windows Defender at its best settings provides real-time scanning that can catch malicious payloads even when they arrive through browser exploits. For users who want additional layers of protection beyond the built-in Windows solution, exploring dedicated antivirus options is a sensible step — you can browse our range of antivirus software to find the right fit for your device and budget.
Keeping Windows itself updated is equally important. Many exploits chain a browser vulnerability with an OS-level privilege escalation flaw — patching both closes that attack chain entirely.
FAQ
What exactly is the Chrome security update vulnerability CVE-2026-11645?
CVE-2026-11645 is a high-severity out-of-bounds read and write flaw in V8, Chrome’s JavaScript engine. It carries a CVSS score of 8.8 and allows a remote attacker to execute arbitrary code on your device by luring you to a specially crafted webpage. It was being actively exploited before Google released the patch.
Which version of Chrome fixes CVE-2026-11645?
The patched version is Chrome 149.0.7827.103 for Windows, macOS, and Linux. Open Chrome’s menu, go to Help → About Google Chrome, and allow the browser to update automatically. Relaunch when prompted and verify the version number in the same screen.
Do other browsers need to update for this Chrome zero-day too?
Yes, if you use a Chromium-based browser such as Microsoft Edge, Brave, Opera, or Arc, those browsers share the same V8 engine and are vulnerable until their developers push their own updates based on the upstream Chromium patch. Check each browser’s built-in update mechanism and update as soon as a new version is available.
How many Chrome zero-days have been exploited in 2026?
CVE-2026-11645 is the fifth Chrome zero-day vulnerability confirmed as actively exploited in 2026. Google has responded to each with emergency out-of-band patches, but the frequency underscores the importance of keeping auto-updates enabled at all times rather than deferring browser updates.
Does Windows Defender protect against Chrome zero-day exploits?
Windows Defender provides real-time threat detection that can intercept malicious payloads delivered through browser exploits, but it is not a replacement for patching the browser itself. The most effective defence is to apply the Chrome update immediately and ensure Windows Defender (or a third-party antivirus) is active and up to date as a secondary layer of protection.
