Google releases Chrome update to fix eighth exploited zero-day of 2026

a heart is shown on a computer screen — Alexander Sinn / Unsplash

Google has released a security update for its Chrome browser to address a high-severity vulnerability that is already being exploited in the wild. This patch resolves the eighth zero-day flaw in the browser that has been actively used for attacks since the beginning of 2026.

The critical vulnerability, identified as CVE-2026-125350, is a use-after-free error located in the XML component of the browser. A use-after-free bug occurs when a program attempts to access a memory location that has already been freed. If an attacker successfully exploits this type of flaw, it can lead to data corruption, application crashes, or the execution of arbitrary code. Google has confirmed that an exploit for this specific vulnerability is being used in real-world attacks, although the company has not disclosed the specific methods of exploitation or the identity of the attackers behind the campaigns.

The security update for the Chrome Stable Channel on desktop platforms fixes a total of nine security issues. The most significant of these is the aforementioned zero-day. The remaining fixes address other security bugs, though specific details for those are not highlighted in the immediate release notes. The vulnerability was discovered and reported by an unnamed security researcher on November 6, 2026. Google has not yet assigned a Common Vulnerability Scoring System score to this specific bug.

The company stated that it will restrict access to detailed information about the bug until the majority of users have installed the update. This restriction will remain in place if the bug is found in a third-party library that is used by other projects which have not yet fixed the issue. This approach is intended to prevent attackers from using the detailed technical information to develop new exploits before users are protected.

Users are advised to update their browsers immediately to the latest versions. For Windows and macOS, the updated versions are 157.0.8103.50 and 157.0.8103.51. For Linux, the updated version is 157.0.8103.50. Users can check for and install the update by navigating to the More menu, selecting Help, and then choosing About Google Chrome, followed by the Relaunch option. Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, should also install patches as soon as those specific browser developers release them.

This latest fix brings the total number of exploited zero-day vulnerabilities patched by Google in Chrome since the start of 2026 to eight. Other zero-days fixed earlier this year include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. The consistent release of patches for actively exploited vulnerabilities underscores the ongoing threat landscape facing browser users.