Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company acknowledged in a security advisory published Monday.

CVE-2026-125350: a high-severity use-after-free in Chrome's XML component

The newly patched flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome's XML component. Google said the bug was reported anonymously on November 6 and described the issue as a memory-management error that occurs when software continues to use a pointer to memory that has already been freed. Such bugs can potentially allow attackers to corrupt memory and execute malicious code, although Google has not disclosed how this particular flaw is being exploited, who is behind the attacks, or who might be targeted.

Patch rollout: Chrome 157.0.8103.50/.51 and how users can check

Google released fixes for the flaw in Chrome 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. The company said the update will roll out over the coming days and weeks; users who prefer not to wait can check manually by opening Chrome's Settings menu and selecting About Chrome. Google is keeping further technical details under wraps until enough users have installed the fix, a familiar approach intended to stop other attackers from getting their hands on a working exploit.

Other vulnerabilities fixed in the same release, including CVE-2026-125346

The release addresses eight other security vulnerabilities, among them high-severity flaws affecting WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine. The update also fixes a second use-after-free bug in Chrome's XML component, CVE-2026-125346, which was reported in October by Arni Hardarson of Neonix Security; Google has not indicated that this second vulnerability was being exploited in the wild.

Eight exploited zero-days in 2026 — the year so far and how it compares to 2025

The latest XML vulnerability brings Google's tally of actively exploited Chrome zero-days in 2026 to eight. By June, Google had already patched five such zero-days, including flaws in its V8 JavaScript engine, the Skia graphics library, and its WebGPU implementation. Two more V8 bugs were fixed in September, and the XML fixes have pushed the year's total to eight — the same number of exploited Chrome zero-days Google fixed across all of 2025. Whether the browser maker can make it through the remaining weeks of the year without adding another to the pile is, as The Register put it, "anyone's guess."

What this means for technologists, enterprises, and end users

• Technologists and security teams: Expect to prioritize deployment of Chrome 157.0.8103.50/.51 and to monitor telemetry for exploitation. Google's decision to withhold technical details until broader rollout means teams will need to balance rapid patching against the limited public information on exploitation vectors.
• Enterprises and procurement leaders: The update underscores the importance of established patch-management channels and the ability to push Chrome updates quickly across endpoints; the release also contains multiple high-severity fixes beyond the XML bugs that may affect different application stacks.
• End users: With Google confirming an exploit exists in the wild, users are advised to update promptly — either by waiting for the automatic rollout or by checking About Chrome in Settings and installing the update immediately.

The record for 2026 now includes eight actively exploited Chrome zero-days, an aggressive cadence that matched last year's total before the calendar had closed. Google has acknowledged active exploitation for CVE-2026-125350, patched it in the 157.0.8103.50/.51 releases, and withheld deeper technical details until the patch reaches more users. The concrete next steps are simple and immediate: install the update when it appears or check About Chrome and trigger it yourself; beyond that, the only remaining question in the short term is whether another exploited zero-day will emerge before year-end.

Original story: https://www.theregister.com/security/2026/11/10/chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8/5308732