BREAKING ALERT — CHROME ZERO-DAY PATCHED; ACTIVE EXPLOITATION CONFIRMED (CVE-2026-11645)

Google has patched a fifth actively exploited Chrome zero-day vulnerability in 2026 — CVE-2026-11645. All Chrome users and enterprise administrators should update to the latest stable release immediately.

DETAILS

  • CVE-2026-11645 is a zero-day vulnerability in Google Chrome confirmed to have been exploited in the wild prior to patching.
  • Google released a fix following a report submitted in late April 2026 by an anonymous researcher; attribution of active exploitation to a specific threat actor is not yet confirmed in available reporting.
  • This marks the fifth Chrome zero-day exploited in 2026, indicating a sustained and elevated targeting tempo against the Chrome browser this year.
  • Technical details of the vulnerability type (e.g., memory corruption, use-after-free, type confusion) have not been confirmed in available source material at this time — Google typically withholds specifics until a majority of users have patched.
  • The vulnerability was reported to Google in late April 2026; the patch timeline between report and public release is not specified in current reporting.

IMPACT

  • Scope: All users and organizations running unpatched versions of Google Chrome across desktop platforms (Windows, macOS, Linux). Mobile impact is unconfirmed at this time.
  • Context: The 2026 Verizon DBIR and concurrent BleepingComputer analysis confirm browser-based attacks are a dominant intrusion vector this year, elevating the risk profile of this vulnerability.
  • Enterprise environments with managed Chrome deployments or Chromium-based browsers (Edge, Brave, Opera) should assess exposure — patch applicability to Chromium derivatives is not yet confirmed in available reporting.
  • Given active exploitation prior to patch release, some organizations may already be compromised.
  1. Update Chrome immediately — navigate to chrome://settings/help or deploy via enterprise management tooling. Verify version reflects the patched release once Google publishes the specific version number.
  2. Prioritize patch deployment in environments where Chrome is used for sensitive workflows, financial systems, or privileged access.
  3. Review browser-based endpoint telemetry for anomalous activity, particularly given confirmed pre-patch exploitation window.
  4. Monitor Chromium-based browser vendor advisories (Microsoft Edge, Brave, etc.) for downstream patch releases.
  5. Do not wait for scheduled patch cycles — active exploitation is confirmed.

SOURCES

  • SecurityWeek: Google Patches 5th Chrome Zero-Day Exploited in 2026 (primary)
  • BleepingComputer: What 2026 DBIR Confirms: Attacks Are Living in the Browser (contextual)
  • Qualys / Verizon DBIR 2026 (contextual threat landscape)

⚠ NOTE: Vulnerability type, affected Chrome version range, and threat actor attribution remain unconfirmed pending full Google advisory publication. This alert will require update as additional technical details are released.