Google patches eighth Chrome zero-day exploited in attacks this year

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. The vulnerability is CVE-2026-125350. In a Monday security advisory, Google said, "Google is aware that an exploit for CVE-2026-125350 exists in the wild," which Sergiu Gatlan quotes in BleepingComputer's report, published November 10, 2026, at 03:51 AM.

This piece is for people who run Chrome on the desktop and for administrators who update the browser on Windows, macOS, and Linux. It covers the use-after-free in Chrome's XML component, how a later read of freed memory can lead to malicious code, the Stable Desktop versions now rolling out, and the install that follows the next launch. It also names the seven other exploited Chrome zero-days Google has fixed since the start of the year, and the limits the Monday advisory places on bug details and links.

01XML use-after-free in Chrome

Google explained that this flaw stems from a use-after-free weakness, or UAF, in the XML component of the Google Chrome web browser. It occurs when the browser's XML parser processes data, deletes an object from the computer's memory, and fails to clear the pointer referencing that object. The pointer stays after the object has been deleted.

The memory that held the deleted object is the freed space in Google's description of the bug, and the pointer referencing that object is the one the XML parser fails to clear. Use-after-free, shortened to UAF, is the name Google gives that failure in the XML component of the Chrome web browser. The Monday security advisory identifies the weakness as CVE-2026-125350.

02Freed memory and malicious code

Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that freed memory space. That space is the memory left after the XML parser deletes an object and fails to clear the pointer that still references it. Reaching it lets an attacker manipulate the memory layout and execute malicious code.

While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents. The Monday security advisory states the confirmation in the company's words: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." CVE-2026-125350 is the eighth Chrome zero-day exploited in attacks and patched since the start of the year.

03Restricted bug details and links

Google said access to bug details and links may be kept restricted until a majority of users are updated with a fix. The material that may stay restricted is the bug details for CVE-2026-125350 and the links that accompany them. Google may keep that restriction in place until a majority of users are updated with the Stable Desktop fix, and it said so in the Monday security advisory.

Google noted, "We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed." If the bug is in a third party library that other projects depend on, and those projects have not yet fixed it, Google will keep the restrictions. The Monday advisory pairs this condition with the one that waits until a majority of users are updated with a fix.

04Stable Desktop builds rolling out

Google has fixed the zero-day for users on the Stable Desktop channel, with new versions rolling out to Windows, macOS (157.0.8103.50/.51), and Linux users (157.0.8103.50). Google says the security update could take days or weeks to reach all Chrome users. The update was available immediately when BleepingComputer checked for updates on November 10, 2026.

Users who do not want to update the web browser manually can let Chrome check for updates on its own. Chrome will automatically install them after the next launch. A manual update remains available for anyone who wants the Stable Desktop fix for CVE-2026-125350 installed before that next launch.

On macOS the Stable Desktop builds are 157.0.8103.50 and 157.0.8103.51, listed as 157.0.8103.50/.51. Linux users receive 157.0.8103.50. Windows is in the same Stable Desktop rollout that delivers the fix for CVE-2026-125350.

05Seven earlier zero-days this year

Since the start of the year, Google has addressed seven other actively exploited zero-day vulnerabilities. An iterator invalidation bug, CVE-2026-2441, in CSSFontFeatureValuesMap, Chrome's implementation of CSS font feature values, was addressed in mid-February. Two other Chrome zero-days exploited in attacks were patched in March: an out-of-bounds write weakness in the Skia 2D graphics library, CVE-2026-3909, and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine, CVE-2026-3910.

A use-after-free weakness in Dawn, CVE-2026-5281, was patched in April. Dawn is the underlying cross-platform implementation of the WebGPU standard used by the Chromium project. An out-of-bounds read and write vulnerability in Chrome's V8 JavaScript engine, CVE-2026-11645, was exploited in the wild and patched in June, and September's fixes covered an out-of-bounds write, CVE-2026-87491, and a type confusion flaw, CVE-2026-85046, both in the V8 JavaScript engine.

Google fixed eight more zero-days exploited in attacks in 2025. Many of them were reported by the company's Threat Analysis Group, or TAG, which tracks zero-day exploits used in spyware attacks. CVE-2026-125350 is the eighth exploited Chrome zero-day Google has patched since the start of the year, after the seven flaws fixed from mid-February through September.