Emerging Threats

Google Patches Chrome Zero-Day Flaw Exploited in the Wild

Analyst 207||Source: InfoSecMag
Laptop screen on a minimalist desk with a blurred display and a subtle bug icon in the background.

$55,000 was awarded to the researcher who reported CVE-2026-11645.

Emergency patch: scale and severity

Google on June 8 released an emergency update addressing 74 vulnerabilities in Chrome, including a high-severity defect that the company says has been "exploited in the wild." The security bulletin lists fixes for 17 critical vulnerabilities, 55 high-severity ones and two medium-severity ones. Google said the security fixes will roll out "over the coming days/weeks" for Chrome users on Windows, Mac and Linux.

Details of the exploited bug: CVE-2026-11645

CVE-2026-11645 is described as an out-of-bounds read and write vulnerability affecting V8 in Google Chrome versions prior to 149.0.7827.103. When exploited, the bug "allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page." The flaw has been assigned a high-severity rating of 8.8.

Google credited a security researcher identified as '303f06e3' with reporting the flaw on April 27. According to the bulletin, the researcher has previously reported Chrome vulnerabilities and was awarded $55,000 for disclosing CVE-2026-11645 to the Chrome security team.

Google's disclosure posture and evidence of exploitation

The company confirmed it is aware of the flaw being exploited in the wild but did not provide additional details about the exploitation evidence. In its advisory Google said: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix." It added: "We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on, but haven’t yet fixed."

Those statements frame the limited public detail about proof of active exploitation: Google maintains restrictions on technical information until updates reach a large share of users, and may continue those restrictions when the vulnerability involves third‑party libraries used across projects.

What this means for technologists, enterprises, and end users

  • Technologists and security teams: prioritize tracking the Chrome rollout across Windows, Mac and Linux and prepare to validate that affected versions prior to 149.0.7827.103 are updated. Expect restricted bug details until updates are broadly deployed, particularly where third-party libraries are involved.
  • Enterprises and procurement leaders: plan accelerated patching windows and verification, given that Google has labeled CVE-2026-11645 as high severity and confirmed exploitation in the wild. Coordinate inventory of Chrome versions in use to identify systems that require immediate attention.
  • End users: watch for the update as it becomes available over the coming days/weeks and apply it on Windows, Mac and Linux systems to ensure protection against a vulnerability that permits remote execution via crafted HTML.

Context and closing observation

Google noted this is the fifth Chrome zero-day in 2026 that was exploited before a patch was available. That cadence, coupled with Google's practice of restricting technical details until a majority of users receive fixes or until dependent projects have issued their own fixes, leaves administrators and defenders balancing speed of deployment against limited public indicators about active exploitation.

For now, the concrete actions are narrow and direct: apply the published Chrome updates when they arrive, confirm affected installations are no longer running versions prior to 149.0.7827.103, and monitor for further advisories from Google about related third-party library fixes and any expanded disclosure.

Original story: https://www.infosecurity-magazine.com/news/google-patch-chrome-vulnerability/

Browser SecurityChromeEmerging ThreatsGooglePatch ManagementVulnerability ManagementZero-DayCVE-2026-11645Out-of-Bounds Read And WriteV8
Related Intelligence

Continue Reading

Somber figure stands in brightly-lit French government building interior with subtle digital interface hint.

France Investigates Breach of Government Messaging Platform

French authorities are on high alert after a hacker hijacked a user account on a government messaging platform, sparking an investigation into the breach. The attacker claims to have accessed far more data than initially reported, raising concerns about the security of sensitive information.

Analyst 207
Developer workstation with laptop and blurred terminal screen, highlighting supply chain security concerns.

PyPI Packages Poisoned in Hades Supply Chain Attack

Malicious actors have launched a supply-chain attack on the Python Package Index (PyPI), infecting 19 packages with 37 tainted versions that can download and execute a hidden JavaScript payload. This sneaky Hades campaign uses poisoned Python packages to spread its reach, putting developers and users at risk.

Analyst 207
Government office workstation with blurred computer screen and muted decor.

French Govt Messaging Service Breached in Account Hijacking Attack

France's digital affairs directorate swiftly sprang into action, blocking a compromised account that was used to hijack a government messaging service, and is now conducting a thorough investigation to assess the damage. The breach was detected by the French Cybersecurity Agency, allowing authorities to shut down the attacker's access and analyze what data was exposed.

Analyst 207
Laptop in office setting with remote access VPN connection setup, hinting at security vulnerability.

Check Point Discloses Zero-Day Auth Bypass Bug Under Active Exploitation

A critical authentication flaw, CVE-2026-50751, has been discovered in Check Point's Remote Access VPN and Mobile Access solutions, allowing attackers to bypass user authentication and establish a remote access VPN connection without a valid password. This severe vulnerability, scoring 9.3 on the CVSS scale, affects deployments using the outdated IKEv1 key exchange protocol.

Analyst 207