Chrome's Eighth Exploited Zero-Day of 2026 Patched Amid Attacks

Google shipped an emergency Chrome desktop update on Monday for CVE-2026-125350, a high-severity use-after-free flaw in the browser's XML component that attackers are already exploiting — the eighth actively abused Chrome zero-day patched so far in 2026.

The fix lands in Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux, with Google saying the rollout will reach users "over the coming days/weeks." Anyone who wants the patch immediately can open Chrome's About page and relaunch the browser. Waiting is a bad idea when the flaw is live in the wild.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the Chrome Releases blog said. An anonymous researcher reported the bug on Nov. 6, just three days before Google shipped the fix — a notably fast turnaround from report to patch.

What do we know about the attacks?

Almost nothing, and that's deliberate. Google has not described the attacks or attributed them to any actor. SecurityWeek reported that no public information on the exploitation was available when it covered the patch. Google routinely keeps bug details restricted until most users have updated, a policy that blurs the picture for defenders but denies attackers easy blueprints.

How does this bug class work?

Use-after-free flaws let an attacker reference memory after the browser has freed it. That can corrupt memory and, when chained with other flaws, lead to code execution. For browser bugs of this kind, the usual delivery route is a malicious web page that triggers the XML parser.

What else did the update fix?

The update patches nine vulnerabilities in total. Seven carry high-severity ratings:

• CVE-2026-125350 — the exploited XML use-after-free
• CVE-2026-125346 — a second XML use-after-free, reported by Arni Hardarson of Neonix Security
• High-severity bugs in WebGL, FileSystem, Compositing, the GPU process and the V8 JavaScript engine, all found internally by Google

Two medium-severity GPU flaws round out the list. The internal discovery of five of the seven high-severity bugs suggests Google's own fuzzing and auditing pipelines are doing real work — even as commercial exploit developers keep finding the gaps.

Why does the count keep climbing?

SecurityWeek counts CVE-2026-125350 as the eighth Chrome zero-day exploited in the wild during 2026. It follows CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491. The previous one, CVE-2026-87491, was an out-of-bounds write in V8 that Google patched on Sept. 9.

One administrative gap remains. The bug had not yet been added to CISA's Known Exploited Vulnerabilities catalog at the time of SecurityWeek's report. That listing matters operationally, because it sets a hard patch deadline for U.S. federal agencies. Until CISA adds it, agencies are on their own schedule — and their own judgment.

Who else needs to patch?

The reach extends well beyond Chrome itself. Other Chromium-based browsers, including Microsoft Edge, Brave and Opera, typically ship the same fix after Google releases it. Users of those browsers should watch for their own update cycles rather than assume Chrome's patch has them covered.

For Chrome, the cadence shows no sign of slowing: eight in-the-wild zero-days with roughly seven weeks left in the year means 2026 has already matched the punishing pace of recent exploit-heavy years, and every unpatched desktop running an older build of 157 is a target until the rollout completes.