Google patches Chrome's eighth actively exploited zero-day of 2026, an XML use-after

Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux fixes CVE-2026-125350, a high-severity use-after-free in the XML component [1] .

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said; an anonymous researcher reported it on Nov. 6 [1] .

SecurityWeek counts it as the eighth exploited Chrome zero-day patched this year; the seventh, a V8 flaw, was fixed in September [2] [3] .

Google released a Chrome desktop update on Monday to fix CVE-2026-125350, a high-severity use-after-free vulnerability in the browser's XML component, and said attackers are already using it. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the Chrome Releases blog said [1] .

The fix ships in Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, which Google said will roll out "over the coming days/weeks" [1] . Users can force the update by opening Chrome's page and relaunching the browser.

Reported three days before the patch

An anonymous researcher reported the bug on Nov. 6, three days before Google shipped the fix [1] . Google has not described the attacks or who is behind them, and SecurityWeek said no public information on the exploitation was available when it reported the patch [2] . Google routinely keeps bug details restricted until most users have updated.

Use-after-free bugs let an attacker reference memory after it has been freed, which can corrupt memory and, chained with other flaws, lead to code execution. A malicious web page that triggers the XML parser is the usual delivery route for browser bugs of this kind.

The update fixes nine vulnerabilities in all [1] . Seven are rated high: the exploited flaw, a second XML use-after-free (CVE-2026-125346) reported by Arni Hardarson of Neonix Security, and bugs in WebGL, FileSystem, Compositing, the GPU process and the V8 JavaScript engine that Google found internally. Two medium-severity GPU flaws round out the list [1] .

Eighth exploited Chrome bug this year

SecurityWeek counts CVE-2026-125350 as the eighth Chrome zero-day exploited in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491 [2] . The one, CVE-2026-87491, was an out-of-bounds write in V8 that Google patched on Sept. 9 [3] . The bug had not yet been added to CISA's Known Exploited Vulnerabilities catalog at the time of SecurityWeek's report, a listing that would set a patch deadline for U.S. federal agencies [2] . Other Chromium-based browsers, including Microsoft Edge, Brave and Opera, typically ship the same fix after Google.