Google patches an exploited Chrome XML flaw, the browser's eighth zero-day this year
CVE-2026-125350 is a high-severity use-after-free bug. Google says an exploit exists in the wild but has shared no details about the attacks.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Google has released emergency Chrome updates that fix CVE-2026-125350, a high-severity use-after-free vulnerability in the browser's XML component. In a Monday advisory, Google said it is aware that an exploit for the flaw exists in the wild. A researcher who wants to remain anonymous reported the bug on November 6. The flaw occurs when Chrome's XML parser deletes an object from memory but leaves a pointer that still references it. An attacker can use that stale pointer to manipulate memory and run malicious code. Google has not described the attacks. It says access to bug details may stay restricted until most users have updated. It is the eighth actively exploited Chrome zero-day of 2026. The fixes are in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, now rolling out in the Stable Desktop channel. The release also patches six other high-severity flaws in the WebGL, FileSystem, Compositing, GPU, V8 and XML components, plus two medium-severity GPU bugs. According to SecurityWeek, CISA had not yet added the vulnerability to its Known Exploited Vulnerabilities catalog. Users should check that Chrome has updated and restart the browser to apply the fix.