Chrome's zero-day Whac-A-Mole continues with fifth exploited bug of the year

Google released security updates for 74 vulnerabilities, including the high-severity CVE-2026-11645 zero-day. This flaw, an out-of-bounds memory access in the V8 JavaScript and WebAssembly engine, is the fifth exploited bug this year. The vulnerability carries a CVSS score of 8.8 and affects Chrome versions prior to 149.0.7827.103. A researcher earned a $55K bounty for the discovery. Google urges users to patch immediately as the vulnerability has been actively exploited in the wild.