Google Issues Emergency Patch for Actively Exploited Zero-Day Vulnerability in Chrome Browser
Technology giant Google has issued an urgent, out-of-band security update for its Chrome web browser following the discovery of an actively exploited zero-day vulnerability in its V8 JavaScript engine. Tracked as CVE-2026-11645, the high-severity security flaw allows malicious actors to perform unauthorized read and write operations on the browser's JavaScript heap, paving the way for arbitrary code execution on compromised devices.
The security bug was initially discovered and responsibly disclosed on August 4, 2026, by cybersecurity researcher Salvatore Gulizia (also known as Serotav), who was awarded a $1,000 bug bounty by Google. The vulnerability stems from a compiler flaw within the V8 engine, where array elements are improperly assigned map data structures. By tricking a target user into visiting a specially crafted HTML web page, remote attackers can break out of the browser's memory boundaries and execute malicious payloads directly inside the endpoint environment.
Google confirmed that real-world exploits leveraging this vulnerability have already been detected, making immediate browser patching essential across personal and enterprise devices. The emergency fix has been rolled out in Chrome Stable version 151.0.7922.180 for Windows, macOS, and Linux operating systems. Other Chromium-based web browsers, including Microsoft Edge, Brave, and Opera, are also expected to deploy corresponding security updates to mitigate risk.
Cybersecurity experts strongly advise individual users and corporate IT administrators to manually verify and update their Google Chrome installations immediately rather than waiting for automatic background updates to complete.
