Chrome Hits Fifth Zero-Day of 2026: Google Pays $55,000 Bug Bounty
Google has
patched its fifth actively exploited Chrome zero-day vulnerability of 2026,
tracked as CVE-2026-11645. The flaw, an out-of-bounds memory access bug in
Chrome's V8 JavaScript engine, was confirmed by Google to be exploited in the
wild at the time of disclosure. The security researcher who discovered the
vulnerability was awarded a $55,000 bug bounty.
This marks an
unprecedented year for Chrome vulnerabilities, with five zero-days addressed in
less than six months. Security analysts describe the pattern as a
"zero-day Whac-A-Mole," where patching one critical flaw quickly
gives way to the emergence of another.
"The V8
engine is a particularly complex attack surface," explained a browser
security researcher. "Memory safety bugs in JavaScript engines can be
weaponized to achieve remote code execution, making rapid patching absolutely
critical."
Google has
released updates across all supported platforms — Windows, macOS, Linux, and
Android. Users are strongly urged to update their browsers immediately.
Enterprise administrators should enforce automatic updates across all managed
devices and consider deploying browser isolation technologies as an additional
layer of protection.
Comments