Google has issued an emergency security update for its Chrome web browser to address a high-severity vulnerability that is currently being exploited in the wild. This flaw, tracked as CVE-2026-125350, marks the eighth zero-day vulnerability patched by the company since the beginning of 2026.
The vulnerability is categorized as a use-after-free weakness located within the browser’s XML component. This type of memory corruption occurs when the software processes XML data and deletes an object from memory but fails to properly clear the pointer that references it. If an attacker successfully triggers this condition, they can manipulate the browser’s memory layout to execute arbitrary malicious code.
Google confirmed the existence of active exploits for this vulnerability in a security advisory released on Monday. While the company acknowledged that the bug is being leveraged in real-world attacks, it has provided minimal information regarding the nature of these incidents. Google stated that it intends to restrict access to technical details and bug reports until a significant portion of the user base has successfully applied the security patches. This restriction is also intended to protect users of third-party libraries that rely on the same affected code and may not yet have implemented a fix.
The patch is currently rolling out to the Stable Desktop channel. Users on Windows and macOS should ensure their browser is updated to version 157.0.8103.50 or 157.0.8103.51, while Linux users should update to version 157.0.8103.50. Although Google noted that the update process can take several days or weeks to reach all global users, the fix is available for manual installation immediately through the browser’s update settings.
This latest incident continues a trend of frequent security interventions for the browser throughout the year. CVE-2026-125350 follows seven other zero-day vulnerabilities that Google has addressed since January 2026. These previous issues spanned various components of the browser, including the V8 JavaScript and WebAssembly engine, the Skia 2D graphics library, the Dawn WebGPU implementation, and the CSSFontFeatureValuesMap.
The previous vulnerabilities patched this year include an iterator invalidation bug in February, two separate flaws in the Skia and V8 engines in March, a use-after-free issue in Dawn in April, an out-of-bounds read and write error in V8 in June, and two additional V8 engine flaws—an out-of-bounds write and a type confusion error—fixed in September.
These recurring security challenges highlight the ongoing efforts of Google’s security teams, including the Threat Analysis Group, which frequently monitors for zero-day exploits often associated with sophisticated spyware campaigns. As with previous disclosures, the company maintains a policy of withholding specific exploit details to prevent further abuse while the update propagates across the ecosystem.
Users are encouraged to restart their browsers to trigger the automatic update process or to manually check for updates via the browser menu to ensure they are protected against the current threat.
