Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google released updates on Monday to patch nine security vulnerabilities, including one actively exploited in the wild.
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned CVE identifier CVE-2026-125350, has been described as a use-after-free bug in the XML component.
Critical vulnerability details
Use-after-free bugs typically occur when a program attempts to access a memory location after it has already been freed. Successful exploitation could allow an attacker to achieve data corruption, program crashes, or arbitrary code execution.
An anonymous security researcher discovered and reported the flaw on November 6, 2026. Google acknowledged it is "aware that an exploit for CVE-2026-125350 exists in the wild," but has not revealed additional information about how it's being abused or who is behind the attacks.
User protection measures
With this latest update, Google has addressed a total of eight actively exploited Chrome zero-days since the start of 2026. Users are advised to update their Chrome browser to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux.
To ensure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch. Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, should also apply the fixes when available.
Related
