Chrome's zero-day Whac-A-Mole continues with fifth exploited bug of the year

Google has fixed its fifth actively exploited Chrome zero-day of 2026, and this one earned its finder a $55,000 bounty. The flaw, tracked as CVE-2026-11645, is an out-of-bounds memory access bug in Chrome's V8 JavaScript engine. Google confirmed that the vulnerability is being exploited in the wild, but has disclosed little beyond the bare technical details. The company patched the issue in the latest Stable Channel releases for Windows, macOS, and Linux. It also awarded a $55,000 bounty to the