Chrome patches an XML zero-day already under attack
CVE-2026-125350, a use-after-free in XML handling, is being exploited in the wild. It is the eighth Chrome zero-day Google has confirmed under active attack this year.
Google pushed Chrome 157.0.8103.50/.51 to the stable channel for Windows and Mac on 9 November, with 157.0.8103.50 for Linux. The release fixes CVE-2026-125350, a use-after-free in Chrome’s XML handling, and Google says in its advisory that it is aware an exploit for the bug already exists in the wild.
An anonymous researcher reported the flaw on 6 November, three days before the patch shipped. As usual, Google is withholding technical detail until most users have updated. This is the eighth Chrome zero-day confirmed under active exploitation so far this year, and a separate, narrower patch from the 213-bug release Chrome 157 shipped on 3 November.
Why it matters: this is a live attack, not a theoretical one, and it lands on every Chromium-based browser once Edge, Brave and Opera pull in the fix behind it. Chrome auto-updates for most people, but anyone managing machines on a delayed or pinned build should treat this update as urgent rather than routine.
The caveat: Google hasn’t said who is behind the exploit or how it is being delivered, so there is no detail yet on what an attack looks like beyond “update now.”