Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still to go. The flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome’s XML component, and Google has confirmed that attackers are already exploiting it.

“Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the company said in its security advisory, published on Monday, 9 November 2026. Google has not said who is behind the attacks or who is being targeted.

What the flaw is and how to fix it

The vulnerability was reported anonymously on 6 November and involves a memory management error that occurs when software continues using a pointer to memory that has already been freed. Such bugs can potentially allow attackers to corrupt memory and execute malicious code, although Google has not disclosed how this particular flaw is being exploited.

Google is keeping further technical details under wraps until enough users have installed the fix, a familiar approach intended to stop other attackers from getting their hands on a working exploit. Access to the underlying bug report remains restricted while users deploy the update.

The fix arrives in Chrome 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux. Google has also released an Extended Stable build, 156.0.8078.96, for Windows and macOS. The update fixes nine security vulnerabilities in total, including high-severity flaws affecting WebGL, FileSystem, GPU, Compositing and the V8 JavaScript engine.

The release also fixes a second use-after-free bug in Chrome’s XML component, CVE-2026-125346, reported by Arni Hardarson of Neonix Security in October, although Google has not indicated that this second vulnerability is being exploited.

Check your Chrome version now

Google says the latest update will roll out over the coming days and weeks, but users can check manually by heading to Chrome’s Settings menu and selecting About Chrome. With attackers already making use of the vulnerability, it is worth doing that now rather than waiting for Chrome to get around to it.

The patch only protects a device after the browser is updated and restarted, so users should relaunch Chrome once the update is installed. SecurityWeek reported on 10 November that CISA had not yet added the newly disclosed flaw to its Known Exploited Vulnerabilities catalog.