Google Patches Chrome's Eighth Actively Exploited Zero-Day of 2026

Google shipped a Chrome desktop update on Monday that patches CVE-2026-125350, a high-severity use-after-free flaw in the browser's XML component — and the company says attackers are already using it. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the Chrome Releases blog said.

That admission makes it the eighth Chrome zero-day exploited in the wild patched this year, by SecurityWeek's count. The seventh, an out-of-bounds write in the V8 engine tracked as CVE-2026-87491, was fixed on Sept. 9. This one moved even faster from report to fix: an anonymous researcher filed the bug on Nov. 6, and Google shipped the patch three days later.

What ships in the update?

The fix lands in Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. Google said the rollout will reach users "over the coming days/weeks." Anyone who wants it sooner can open Chrome's About page and relaunch the browser to force the update.

In total, the update fixes nine vulnerabilities. Seven carry a high rating:

• The exploited XML use-after-free, CVE-2026-125350
• A second XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security
• Bugs in WebGL, FileSystem, Compositing, the GPU process and the V8 JavaScript engine, all found by Google internally

Two medium-severity GPU flaws round out the list.

How does the bug work, and who's exploiting it?

Use-after-free bugs let an attacker reference memory after the browser has freed it. That can corrupt memory, and chained with other flaws it can lead to code execution on a victim's machine. For browser bugs of this kind, the usual delivery route is a malicious web page that triggers the XML parser.

Google hasn't described the attacks or named who's behind them. SecurityWeek reported that no public information on the exploitation was available at the time of its coverage. That silence is standard practice — Google routinely keeps bug details restricted until most users have updated, denying copycat attackers a working blueprint.

What's the wider exposure?

The 2026 tally now reads: CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, CVE-2026-87491 and now CVE-2026-125350. Eight actively exploited browser flaws in roughly a year is a pace that keeps Chrome's patch pipeline under steady pressure.

One regulatory shoe hasn't dropped yet. At the time of SecurityWeek's report, the bug had not been added to CISA's Known Exploited Vulnerabilities catalog — the listing that would set a hard patch deadline for U.S. federal agencies. These entries typically follow once exploitation is confirmed, so agencies and enterprises would be wise not to wait for the mandate.

The blast radius extends beyond Chrome itself. Other Chromium-based browsers, including Microsoft Edge, Brave and Opera, share the same underlying code and typically ship the same fix after Google releases it — meaning their users sit exposed for the gap between Google's patch and each vendor's own rollout.

For now, the practical advice is blunt: update Chrome, and don't wait for the automatic rollout. The exploit is in the wild, the fix is three days old, and the attackers who triggered this patch are presumably still working whatever angle they found.