CVE-2026-2441

Google Patches Eighth Actively Exploited Chrome Zero-Day CVE-2026-125350 of 2026

Google released updates addressing nine vulnerabilities in Chrome, including one actively exploited zero-day tracked as CVE-2026-125350. The flaw is a use-after-free issue in the XML component that can lead to data corruption, crashes, or arbitrary code execution. An anonymous researcher reported the bug on November 6, 2026, and Google confirmed in-the-wild exploitation without disclosing attacker details. This marks the eighth actively exploited Chrome zero-day patched by Google since the beginning of 2026. Affected users should immediately update to Chrome version 157.0.8103.50 or later on Windows, macOS, and Linux. Other Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi are also urged to apply equivalent fixes promptly.

Chrome Update Patches Exploited XML Zero-Day CVE-2026-125350, Eighth This Year

Google released Chrome 157 updates addressing nine vulnerabilities, one of which is a high-severity zero-day actively exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free issue in the browser’s XML component and was reported anonymously on November 6. No further details on the attacks have been disclosed, and CISA has not yet added the CVE to its Known Exploited Vulnerabilities catalog. This marks the eighth Chrome zero-day exploited in 2026 after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. The update also resolves six additional high-severity issues in WebGL, FileSystem, Compositing, GPU, V8, and XML, plus two medium-severity uninitialized resource bugs in GPU. Patches are available in versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux.