Google patches eighth Chrome zero-day exploited this year

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.

CVE-2026-125350: a Use-After-Free in Chrome's XML component

Google says the newly patched flaw, tracked as CVE-2026-125350, is a high-severity memory corruption vulnerability caused by a Use-After-Free (UAF) weakness in the browser's XML component. According to the advisory, the problem arises when Chrome's XML parser "processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object." When the browser later tries to use or read that freed memory, an attacker can manipulate the memory layout and execute malicious code.

How Google described exploitation and disclosure controls

Google confirmed it has found evidence of active exploitation but did not provide additional incident details. The company also explained a standard disclosure policy: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed," it noted. That language frames why Google continues to limit public technical detail even after acknowledging in-the-wild use.

Chrome Stable Desktop channel: patched versions and rollout

The zero-day has been fixed for users in the Stable Desktop channel. New Chrome versions are rolling out to Windows, macOS and Linux: macOS updates are listed as 157.0.8103.50 and 157.0.8103.51, and Linux is listed as 157.0.8103.50. Google said the update "could take days or weeks to reach all Chrome users," but BleepingComputer reported the patch was available immediately when it checked for updates. If users prefer not to update manually, Chrome will check for updates and install them automatically after the next launch.

Seven other actively exploited Chrome zero-days in 2026 (so far)

This is the eighth Chrome zero-day that Google says was exploited in attacks since the start of 2026. The company listed seven earlier vulnerabilities patched this year:

• An iterator invalidation bug (CVE-2026-2441) in CSSFontFeatureValuesMap, fixed in mid-February.
• An out-of-bounds write in the Skia 2D graphics library (CVE-2026-3909), patched in March.
• An inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910), patched in March.
• A use-after-free in Dawn, the underlying implementation of WebGPU used by Chromium (CVE-2026-5281), fixed in April.
• An out-of-bounds read and write in V8 (CVE-2026-11645), addressed in June.
• An out-of-bounds write (CVE-2026-87491) in V8, fixed in September.
• A type confusion flaw (CVE-2026-85046) in V8, also fixed in September.

Google additionally noted it fixed eight more zero-days exploited in attacks in 2025, and that many of those were reported by the company's Threat Analysis Group (TAG), which tracks zero-day exploits used in spyware attacks.

What this means for security teams, end users, and threat actors

• Security teams and technologists: Expect to prioritize deployment of the Stable Desktop channel updates across Windows, macOS and Linux endpoints, and to monitor whether Google relaxes its disclosure restrictions once a sufficient user population is patched.
• End users and enterprises: Users should either apply the update immediately or relaunch Chrome so the browser installs the patch automatically; the advisory warns that it may take days or weeks for the update to reach everyone through the normal rollout.
• Threat actors and exploit developers: Google’s confirmation of in-the-wild exploitation but limited public technical detail indicates a window where exploit code and fuller analysis may remain constrained until the company deems a majority of users patched or dependent third-party libraries are fixed.

Google's advisory on CVE-2026-125350 adds to a pattern of actively exploited Chrome zero-days this year and underscores the company's careful, staged approach to public disclosure when exploitation is known. The specific incidents behind this exploit remain undisclosed by Google, and the company maintains disclosure controls until the majority of users receive the update or dependent third-party libraries are remediated.

Original report: https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/