Google Chrome 0-Day Vulnerability Exploited in Active Attacks

Google has released an emergency security update for Chrome, patching a critical zero-day vulnerability (CVE-2026-5281) that is actively being exploited in the wild.

The Stable channel has been updated to version 149.0.7827.102/.103 for Windows and Mac, and 149.0.7827.102 for Linux, with the rollout expected to complete over the coming days and weeks.

The vulnerability currently being actively exploited is CVE-2026-11645, a high-severity out-of-bounds memory access flaw in Chrome’s V8 JavaScript engine. Google has explicitly confirmed that “an exploit for CVE-2026-11645 exists in the wild.”

Google Chrome 0-Day Vulnerability Exploited 

The bug was discovered by external researcher 303f06e3 on April 27, 2026, who earned a $55,000 bug bounty reward, underscoring the critical nature of the flaw.

Out-of-bounds memory access vulnerabilities in V8 are particularly dangerous because the JavaScript engine is exposed to untrusted web content by default.

A threat actor could weaponize this flaw by luring a target to a malicious webpage or injecting a crafted script, potentially achieving arbitrary code execution within the Chrome renderer process. When chained with a sandbox escape, such vulnerabilities can lead to full system compromise.

Beyond the zero-day, this update addresses 74 security vulnerabilities in total, one of the largest single-release patch batches in recent Chrome history. The breakdown by severity is alarming:

• 17 Critical vulnerabilities, nearly all classified as Use-After-Free (UAF) flaws affecting components including Ozone, Aura, TabStrip, Bluetooth, Autofill, Gamepad, Printing, and Web Apps
• 55 high-severity flaws spanning V8, Network, Extensions, ServiceWorker, Payments, WebRTC, GPU, PDF, SVG, Dawn, and more
• 2 medium-severity issues in Tracing and Guest View

Use-After-Free vulnerabilities are among the most exploitable classes of memory corruption. They occur when a program continues to access memory after it has been freed, allowing attackers to manipulate heap memory to redirect execution flow.

The concentration of UAF bugs across so many Chrome components, particularly in Bluetooth, V8, and rendering subsystems, signals a significant internal security audit effort by Google’s own teams, who reported the majority of these bugs between May 25–30, 2026.

Notable additional flaws include integer overflows in libyuv and Media (CVE-2026-11640, CVE-2026-11655, CVE-2026-11678), an out-of-bounds write in GPU (CVE-2026-11672), and a Type Confusion in Bindings (CVE-2026-11662) all of which carry serious exploitation potential.

How to Update Chrome

Don’t wait for the automatic rollout. According to Google’s advisory, to force a manual update:

1. Open Chrome and navigate to chrome://settings/help
2. Chrome will automatically check for and download the latest update
3. Click Relaunch to apply the update
4. Confirm you are running version 149.0.7827.102 or higher

Given the confirmed in-the-wild exploitation of CVE-2026-11645, all Chrome users, especially those in enterprise environments, should treat this update as Priority 1. Full bug details remain restricted until the majority of users are patched.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.