Critical Chrome 0-Day CVE-2023-5217 Exploited, Patch Now

Key Takeaways

• Google has issued an urgent security update for Chrome, addressing a critical zero-day vulnerability (CVE-2026-11645) actively exploited in the wild.
• The flaw resides in Chrome’s V8 JavaScript engine, making it particularly dangerous due to its potential for remote code execution.
• This is the fifth actively exploited Chrome zero-day patched in 2026, highlighting persistent threats to browser security.
• The update also includes 73 other security fixes, with 17 rated as Critical, predominantly addressing use-after-free vulnerabilities.
• Users are strongly advised to update their Chrome browser immediately to versions 149.0.7827.102/.103 (Windows/Mac) or 149.0.7827.102 (Linux).

Google Chrome Zero-Day Actively Exploited

Google has deployed an emergency security patch for its Chrome browser, targeting a critical zero-day vulnerability, CVE-2026-11645, that is currently being exploited in active attacks. This marks the fifth instance of an actively exploited zero-day in Chrome that Google has addressed in 2026.

The most severe issue resolved in this update is CVE-2026-11645, identified as a high-severity out-of-bounds memory access flaw within Chrome’s V8 JavaScript engine. This type of vulnerability in the V8 engine poses a significant risk because the engine processes untrusted JavaScript code from every webpage a user visits. Successful exploitation can lead to memory corruption, data leakage, or, when combined with other vulnerabilities, enable remote code execution simply by tricking a user into visiting a malicious website.

The vulnerability was reported by an external researcher known as “303f06e3” on April 27, 2026, for which Google awarded a substantial bug bounty of $55,000, underscoring the severity and potential impact of the flaw. Google explicitly confirmed its awareness of in-the-wild exploitation, stating, “Google is aware that an exploit for CVE-2026-11645 exists in the wild.” Out-of-bounds memory access vulnerabilities in V8 are especially perilous as attackers can leverage them to execute arbitrary code within the browser’s rendering process, potentially leading to sandbox escapes and full system compromise when chained with additional exploits.

Beyond the critical zero-day, this update is comprehensive, delivering a total of 74 security fixes. Among these, 17 are classified as Critical vulnerabilities. A significant portion of these critical flaws are use-after-free (UAF) defects, a common memory-corruption class that continues to be a persistent challenge in browser security. UAF vulnerabilities occur when a program attempts to use a memory pointer after the memory it references has been deallocated. Exploiting such flaws can result in memory corruption, arbitrary code execution, or browser crashes.

Additional Vulnerabilities Patched

The update addresses a wide array of components susceptible to UAF vulnerabilities, including:

• Ozone, Aura, and Views: Core rendering and user interface frameworks.
• Bluetooth and Gamepad: Hardware interface layers.
• TabStrip, Autofill, and Web Apps: Browser feature components.
• Printing, Compositing, and Proxy: Various browser functionalities.
• libyuv: An integer overflow vulnerability, CVE-2026-11640.

High-Severity Flaws Across Core Subsystems

In addition to the critical patches, the release includes 57 high-severity vulnerabilities impacting nearly all of Chrome’s major subsystems. These include flaws in V8 (CVE-2026-11649/11650), WebRTC (CVE-2026-11667), PDF (CVE-2026-11670), ServiceWorker (CVE-2026-11656/11694), Extensions (CVE-2026-11652/11653), Network (CVE-2026-11651/11677), and GPU (CVE-2026-11672). The broad scope of affected components suggests that Google’s internal security researchers conducted an extensive audit between late April and late May 2026.

Other notable vulnerabilities include CVE-2026-11662, a Type Confusion issue in Bindings, and CVE-2026-11688, an Object Lifecycle Issue in SVG. Both Type Confusion and Object Lifecycle flaws are frequently leveraged in complex browser exploit chains.

The Stable channel has been updated to version 149.0.7827.102/.103 for Windows and Mac users, and 149.0.7827.102 for Linux. While Google indicates that the rollout will occur over several days and weeks, manual updating is strongly recommended to ensure immediate protection against the actively exploited zero-day.

What You Should Do

• Update Immediately: Do not wait for automatic updates. Manually update your Chrome browser to the latest version.
• Manual Update Steps:
  1. Open Chrome.
  2. Click the three-dot menu (⋮) in the top-right corner.
  3. Navigate to Help → About Google Chrome.
  4. Chrome will automatically check for and download updates. Click “Relaunch” when prompted to complete the installation.
• Enterprise Administrators: Prioritize deploying version 149.0.7827.102/103 across all managed endpoints without delay, given the confirmed in-the-wild exploitation of CVE-2026-11645.
• Stay Vigilant: Be cautious of suspicious links or websites, as exploitation can occur simply by visiting a malicious page.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.