Google patches eighth exploited Chrome zero-day of 2026

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.

The flaw is a high-severity use-after-free weakness in the XML component of the Google Chrome web browser. It occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object. Attackers can exploit this memory corruption vulnerability when the browser later tries to use or read that freed memory space to manipulate the memory layout and execute malicious code.

An anonymous researcher reported the issue to Google on November 6. Google has not shared additional details about the attacks exploiting the vulnerability.

"Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed," Google noted.

The patches are included in Chrome 157 updates, specifically versions 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. Google says the security update could take days or weeks to reach all Chrome users.

Since the start of the year, Google has addressed seven other actively exploited zero-day vulnerabilities:

• CVE-2026-2441, an iterator invalidation bug in CSSFontFeatureValuesMap, addressed in mid-February
• CVE-2026-3909, an out-of-bounds write weakness in the Skia 2D graphics library, patched in March
• CVE-2026-3910, an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine, patched in March
• CVE-2026-5281, a use-after-free weakness in Dawn, patched in April
• CVE-2026-11645, an out-of-bounds read and write vulnerability in Chrome's V8 JavaScript engine, patched in June
• CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine, fixed in September
• CVE-2026-87491, an out-of-bounds write flaw in the V8 JavaScript engine, fixed in September

Why it matters

This is the eighth Chrome zero-day exploited in attacks that Google has patched in 2026. The company has not identified who is behind the attacks or provided details on how the exploit is delivered. Users can check for the update by opening Chrome, selecting Help and About Google Chrome, and relaunching the browser to complete installation.

---

Sources

• bleepingcomputer.com: Google patches eighth Chrome zero-day exploited in attacks this year
• securityweek.com: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year - SecurityWeek
• securityaffairs.com: Google fixes the eighth actively exploited Chrome zero-day of 2026
• techlicious.com: Update Chrome now: Google patches an exploited zero-day
• mlq.ai: Google patches Chrome's eighth actively exploited zero-day of 2026, an XML use-after-free bug | MLQ.ai
• news.lavx.hu: Google patches eighth exploited Chrome zero-day of 2026 | LavX News

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.