Google Patches Actively Exploited Chrome Zero-Day in Security Update

Google on Monday released updates to patch nine security vulnerabilities in Chrome, including one high-severity zero-day vulnerability that has come under active exploitation in the wild. The flaw, tracked as CVE-2026-125350, is a use-after-free bug in the XML component, and Google says it is aware that an exploit exists in the wild.

The Vulnerability

The issue has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after it has already been freed. Successful exploitation could allow an attacker to achieve data corruption, program crashes, or arbitrary code execution.

Discovery and Response

An anonymous security researcher has been credited with discovering and reporting the flaw on November 6, 2026. Google has not revealed additional specific information related to how the vulnerability is being abused in real-world attacks or who is behind them. The company said access to bug details and links may be kept restricted until a majority of users are updated with a fix.

Update Guidance

For optimal protection, users are advised to update Chrome to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux. Users can navigate to More > Help > About Google Chrome and select Relaunch to ensure the latest updates are installed. Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

Yearly Context

With this release, Google has addressed a total of eight actively exploited Chrome zero-days since the start of the year. The list includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

Sources: The Hacker News