_content/doc/go1.26: document heap address randomization

Change-Id: I7e7bad222e5d1a80a1ecaf7b30e8608d5abc9ba1
Reviewed-on: https://go-review.googlesource.com/c/website/+/734900
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

_content/doc/go1.26.md

diff --git a/_content/doc/go1.26.md b/_content/doc/go1.26.md
index 7de902e..7b0e250 100644
--- a/_content/doc/go1.26.md
+++ b/_content/doc/go1.26.md
@@ -202,6 +202,18 @@
 
 We aim to enable goroutine leak profiles by default in Go 1.27.
 
+### Heap base address randomization
+
+<!-- CL 674835 -->
+
+On 64-bit platforms, the runtime now randomizes the heap base address
+at startup.
+This is a security enhancement that makes it harder for attackers to
+predict memory addresses and exploit vulnerabilities when using cgo.
+This feature may be disabled by setting
+`GOEXPERIMENT=norandomizedheapbase64` at build time.
+This opt-out setting is expected to be removed in a future Go release.
+
 ## Compiler {#compiler}
 
 <!-- CLs 707755, 722440 -->