V8 JavaScript engine

Google Issues Emergency Patch for Eighth Chrome Zero-Day Exploited in Attacks This Year

Google has released emergency security updates to address CVE-2026-125350, a high-severity Use-After-Free vulnerability in the XML component of Chrome that is being actively exploited in the wild. This marks the eighth zero-day exploited in attacks since the beginning of 2026. The flaw allows attackers to manipulate memory layout and execute malicious code after the browser fails to clear a pointer to a deleted object. Google has confirmed exploitation but has not disclosed further details about the incidents or threat actors involved. The company has also listed seven previously patched zero-days exploited this year, including multiple issues in the V8 engine and other components. Patches are now rolling out to Stable Desktop users on Windows, macOS, and Linux.