Google patches new Chrome zero-day flaw exploited in the wild

Google released emergency updates to patch a high-severity Chrome zero-day (CVE-2026-11645) actively exploited in the wild; the flaw is an out-of-bounds read/write in the V8 JavaScript engine that can enable arbitrary code execution from crafted web content and aid in bypassing mitigations like ASLR. Patched Stable channel versions for Windows, macOS, and Linux were issued, and Google limited disclosure while updates roll out; the advisory also notes several other zero-days addressed earlier in the year.