Google has released an emergency Chrome update to fix CVE-2026-125350, a high-severity vulnerability in the browser’s XML component that is already being used in attacks. The company confirmed that it is aware of an active exploit, but has not disclosed who is behind the attacks or how they are being carried out.
The flaw is Chrome’s eighth exploited zero-day since the start of 2026. The stable desktop update, based on Chrome 157, also fixes eight other vulnerabilities: six high-severity and two medium-severity, according to SecurityWeek. Google published the patches on Monday; the company’s advisory offers no details about the incidents.
Google is aware that an exploit for CVE-2026-125350 exists in the wild.
— Google, in its security advisory
A deleted object that retains a reference
CVE-2026-125350 is a use-after-free bug in Chrome’s XML component. It occurs when the browser processes XML data, removes an object from memory, but fails to clear the pointer that still points to it. If it later tries to access that already-freed memory again, an attacker can exploit the situation to alter the process’s memory.
BleepingComputer describes the vulnerability as a high-severity memory corruption issue. The Hacker News notes that this type of flaw can lead to data corruption, program crashes, or arbitrary code execution. Hong Kong’s Computer Emergency Response Team Coordination Centre (HKCERT) also warns that, in this case, a remote attacker could exploit the XML bug and classifies the risk as extremely high.
The CVSS score for CVE-2026-125350 is listed as unavailable by The Hacker News. Google has not published specific information about the campaigns exploiting it. Its advisory explains that technical details and links to the bug may remain restricted until most users have received the fix; it will also maintain that restriction if the issue affects a third-party library used by other projects that have not yet patched it.
An update for Windows, macOS, and Linux
The patch is rolling out to users on the stable desktop channel in Chrome 157. The listed versions are 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. HKCERT identifies earlier versions as affected and recommends installing the fixed version or a later one.
Google warns that the update may take days or weeks to reach all users. BleepingComputer, however, found the patch available immediately when checking for updates on the day it was published. Users who do not want to start the check manually can let Chrome search for and install the update automatically when they reopen the browser.
The Hacker News also provides the steps to check for it: open “More,” go to “Help,” and select “About Google Chrome”; then choose “Relaunch” to complete the installation. The recommendation also applies to users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi, which will need to apply their respective fixes when available.
Nine flaws fixed and eight zero-days in 2026
The update fixes nine vulnerabilities in total, according to The Hacker News and SecurityWeek. In addition to the XML zero-day, Google fixed six high-severity flaws in the WebGL, FileSystem, Compositing, GPU, V8, and XML components. SecurityWeek reports that most were discovered internally by Google. Two medium-severity bugs, described as uninitialized resource issues in the GPU component, were also fixed.
With CVE-2026-125350, Google has now patched eight actively exploited Chrome vulnerabilities since January. The other seven are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.
This year’s record includes an iterator invalidation bug in CSSFontFeatureValuesMap, fixed in mid-February. March brought patches for an out-of-bounds write in the Skia graphics library and an improper implementation in V8, Chrome’s JavaScript and WebAssembly engine. In April, a use-after-free in Dawn, the cross-platform implementation of WebGPU used by the Chromium project, was fixed.
In June, Google fixed an out-of-bounds read and write vulnerability in V8. In September, it fixed two more flaws in the engine: an out-of-bounds write and a type confusion bug. The identifiers for those issues are CVE-2026-11645, CVE-2026-87491, and CVE-2026-85046, respectively. BleepingComputer puts the number of exploited zero-days fixed by Google in 2025 at eight and notes that several were reported by the company’s Threat Analysis Group, which tracks zero-day exploits used in spyware attacks.
No public details about the attacks
An anonymous security researcher reported CVE-2026-125350 to Google on November 6, 2026, according to The Hacker News and SecurityWeek. Their identity has not been disclosed. The people behind the attacks and the targets affected are also not publicly known; Google has not described the observed use beyond confirming that the exploit is in circulation.
SecurityWeek adds that, at the time of publication, CVE-2026-125350 had not yet appeared in CISA’s Known Exploited Vulnerabilities (KEV) catalog. The update Google is already distributing fixes the flaw in the listed desktop versions; Chromium-based browsers are still awaiting their own patches.
Sources: BleepingComputer, The Hacker News, Chrome Releases, SecurityWeek, The Hacker News, Hong Kong Computer Emergency Response Team Coordination Centre
