Chrome’s Eighth Exploited Zero-Day of 2026 Is Fixed. Here Is the Year’s Timeline, and Why Restarting the Browser Matters
Google says an exploit exists in the wild for CVE-2026-125350, a high-severity use-after-free in Chrome’s XML component, and has shipped Chrome 157.0.8103.50/.51 to fix it. It is the eighth actively exploited Chrome flaw this year.
Google has shipped another emergency Chrome update after confirming that attackers already have a working exploit for a newly reported bug. That makes eight separate actively exploited Chrome flaws since January, which is a strong argument for treating browser updates as a weekly chore instead of an occasional one.
The details below come from BleepingComputer’s coverage of the fix, with additional points from SecurityWeek.
The newest bug at a glance
CVE-2026-125350 is a use-after-free weakness in the part of Chrome that parses XML. In plain terms, the browser releases a piece of memory but keeps a pointer to it, and an attacker who can shape what later fills that space may be able to run code. Google rates it high severity. An anonymous researcher reported it on November 6, and Google’s Monday advisory says the company is aware that an exploit exists in the wild. Google has not described the attacks, and it routinely keeps bug details restricted until most users have updated.
A year of exploited Chrome bugs
- February: CVE-2026-2441, an iterator invalidation bug in Chrome’s handling of CSS font feature values.
- March: two at once, CVE-2026-3909, an out-of-bounds write in the Skia graphics library, and CVE-2026-3910, an inappropriate implementation flaw in the V8 JavaScript and WebAssembly engine.
- April: CVE-2026-5281, a use-after-free in Dawn, the code behind Chrome’s WebGPU support.
- June: CVE-2026-11645, an out-of-bounds read and write in V8.
- September: another pair in V8, CVE-2026-87491 (out-of-bounds write) and CVE-2026-85046 (type confusion).
- November 9: CVE-2026-125350 in the XML component, fixed in this release.
For context, Google patched eight exploited Chrome zero-days across all of 2025 as well.
What else is in the update
SecurityWeek counts nine fixes in total. Besides the zero-day, there are six more high-severity issues in WebGL, FileSystem, Compositing, GPU, V8 and XML, most found by Google itself, plus two medium-severity uninitialized resource problems in the GPU code. At the time of SecurityWeek’s report, CISA had not yet added the zero-day to its Known Exploited Vulnerabilities catalog.
Which version you need
The fixed builds are Chrome 157.0.8103.50 or .51 on Windows and Mac, and 157.0.8103.50 on Linux. Google says the rollout can take days or weeks to reach everyone, though BleepingComputer found the update offered right away. Chrome downloads updates on its own, but they only take effect after the browser is relaunched.
What this means for your company
A browser bug like this needs nothing more than a visit to the wrong page, and many staff leave their browsers open for weeks, which means a downloaded fix may never actually be running. Have someone confirm the Chrome version across your computers today, and push a relaunch if machines are behind. Longer term, manage browsers centrally so updates and restart deadlines are enforced by policy, include other Chromium-based browsers your staff use in the same check, and remove browsers nobody needs. Pair that with web filtering and endpoint protection so a single missed update is not the only thing between an employee and an exploit.
Would you like to know how many of your computers are running an out-of-date browser right now? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
