Google patches new Chrome zero-day flaw exploited in the wild

Google released a Chrome 149 update fixing 74 vulnerabilities, including CVE-2026-11645, a high-severity V8 out-of-bounds read/write exploited in the wild. An anonymous researcher reported the flaw in late April and received a $55,000 bounty. This is the fifth Chrome zero-day exploited in 2026.