Google has patched a Chrome zero-day flaw that attackers are already exploiting in the wild, urging users to update their browsers immediately. The vulnerability, tracked as CVE-2026-125350, is a use-after-free bug in Chrome's XML component, and Google confirmed in its security advisory that it is aware an exploit for the flaw exists in the wild.

The fix arrived in Chrome 157.0.8103.50 and 157.0.8103.51 for Windows and Mac, and Chrome 157.0.8103.50 for Linux. An anonymous researcher reported the flaw to Google on 6 November 2026, and the company shipped a patch within days, underlining how serious the threat is. Google has not said who is behind the attacks or who the targets are.

What the CVE-2026-125350 flaw does

A use-after-free flaw occurs when software keeps using a block of memory after it has been freed. An attacker who can control that memory can often corrupt data or run code. In a browser, this kind of flaw is usually triggered when a victim visits a specially crafted web page, which means the attack can begin with nothing more than a malicious link.

Google is holding back technical details of the flaw, as it does with most actively exploited bugs. The company says access to bug details may be kept restricted until a majority of users are updated with a fix. That policy is designed to stop other attackers copying the exploit before users have had a chance to patch.

Nine flaws fixed in Chrome 157 update

The same update fixes eight other security flaws. Seven of the nine are rated high severity and two are rated medium. The other fixes include a second use-after-free flaw in the XML component, tracked as CVE-2026-125346, and a type confusion bug in the V8 JavaScript engine, tracked as CVE-2026-125344.

Google also patched a compositing buffer overflow, an out-of-bounds write in the graphics processor code, a FileSystem authorisation flaw, and three uninitialised resource bugs in WebGL and GPU code. Google has not reported exploitation for any of these eight flaws, but they should still be patched promptly because they could be abused once details become public.

How to update Chrome now

Chrome normally updates itself in the background, but users should check manually because Google says this rollout will take days or weeks to reach everyone. Open Settings, then About Chrome, and let the browser check for the update. Click Relaunch to finish installing it.

Users of other Chromium-based browsers, including Edge, Brave and Opera, should watch for their own updates, because they share Chrome's underlying engine and may carry the same flaw. Anyone running Chrome on a work computer should also make sure their IT team has pushed the update, since browsers that are left unpatched remain an easy way into a company network.

The flaw is the latest in a series of Chrome zero-days patched this year. Each one is a reminder that the browser is now one of the most attacked pieces of software on a computer, and that keeping it updated is one of the simplest and most effective security steps any user can take.