Chrome zero-day

Google released updates on Monday addressing nine security vulnerabilities in Chrome, and one of them is already being used against real targets.

The flaw is CVE-2026-125350, a high-severity use-after-free bug in the XML component. Google has not published a CVSS score, and it has not released details about who is exploiting it or how.

The company acknowledged it is "aware that an exploit for CVE-2026-125350 exists in the wild." That is the full extent of the public statement.

What a Use-After-Free Actually Means

A use-after-free occurs when a program tries to access memory it has already released. The pointer still exists, but the memory behind it does not belong to the program anymore.

What happens next depends on what has been allocated into that freed space. An attacker who can control that allocation can turn the dangling pointer into a write primitive. From there, the path typically runs toward data corruption, a crash, or arbitrary code execution.

That is why browsers treat these as serious even before exploitation is confirmed. Once exploitation is confirmed, they become urgent.

The Researcher and the Anonymity

An anonymous researcher is credited with discovering and reporting the flaw on November 6, 2026.

That is worth noting. Chrome bug bounties attract a mix of named researchers, independent security firms, and people who prefer to remain unattributed. Anonymous reports are not unusual, and they are not a red flag. But they do mean the public has no way to cross-reference the finding against other research.

Why Google Is Withholding Details

Google's standard practice is to restrict access to bug details and links until most users have updated. It also retains restrictions when the bug exists in a third-party library that other projects depend on and have not yet fixed.

That second clause is the interesting one. If the XML component flaw traces back to a shared dependency, then other browsers and applications using that dependency may also be affected. Google is not saying whether that is the case here, but the withholding language is the same it uses when it is.

The 2026 Chrome Zero-Day Count

With this patch, Google has addressed eight actively exploited Chrome zero-days since the start of the year.

Eight in roughly ten months. That is not an anomaly. It is the current tempo of browser exploitation.

How to Update

The fixed versions are:

• Windows and macOS: 157.0.8103.50 or 157.0.8103.51
• Linux: 157.0.8103.50

To update, open Chrome, navigate to More > Help > About Google Chrome, and select Relaunch once the update downloads.

That relaunch step matters. Chrome downloads updates in the background but does not apply them until the browser restarts. A machine can show as "up to date" in the menu and still be running the vulnerable binary until someone clicks Relaunch.

What About Other Chromium Browsers

Microsoft Edge, Brave, Opera, and Vivaldi all build on Chromium. They will receive the fix, but on their own timelines.

That lag is the exposure window. A user who updates Chrome immediately and keeps Edge open for the rest of the day has not eliminated the risk.

For organizations, the practical answer is to check the Chromium version underlying each browser in your fleet and set a patch deadline that accounts for the slowest one.

What Defenders Should Do

• Update Chrome on every managed device. Push through your patch management tool, and verify the version after the restart.
• Force the relaunch. A background download without a restart leaves the user on the vulnerable build. Consider enforcing relaunch policies through your management platform.
• Check Chromium-based browsers separately. Edge, Brave, Opera, and Vivaldi each track their own release cadence.
• Watch for exploitation indicators. A use-after-free that reaches code execution often leaves crash artifacts. Chromium crash telemetry on managed endpoints can surface exploitation attempts before they succeed.
• Prioritize browsers on high-value endpoints. Executive laptops, developer machines, and anything with privileged access gets patched first.
• Do not rely on the version number alone. Confirm the binary actually restarted. chrome://version after the relaunch is the check.

Why This One Is Worth Acting On Today

An actively exploited zero-day in a browser is not a theoretical risk. The browser is the most exposed application on most endpoints, and a use-after-free that reaches execution can run code with the user's privileges.

Google has confirmed exploitation. The patch exists. The only question is how many machines are still running 157.0.8103.49 or earlier when someone tries it.

FAQ

What is CVE-2026-125350?

It is a high-severity use-after-free vulnerability in Chrome's XML component. Google has confirmed that an exploit exists in the wild.

How serious is the issue?

No CVSS score has been released by Google. The vulnerability carries a high level of severity risk, and use after free vulnerabilities may result in data corruption, crashes, or even arbitrary code execution.

Affected versions of Chrome?

Version 157.0.8103.50 and 157.0.8103.51 on Windows and macOS, and version 157.0.8103.50 on Linux.

How do I update Chrome?

Open Chrome, go to More > Help > About Google Chrome, and select Relaunch once the update downloads.

Why is the relaunch important?

Chrome downloads updates in the background but does not apply them until the browser restarts. A device can show as updated and still be running the vulnerable binary.

Are Edge, Brave, Opera, and Vivaldi affected?

They are built on Chromium, so they will receive the fix on their own schedules. Until they do, they carry the same exposure.

Who discovered the bug?

The bug was anonymously discovered on November 6, 2026.

Why hasn't Google released more details?

Google restricts bug details until most users have updated, and it retains restrictions if the bug exists in a third-party library other projects depend on.

How many Chrome zero-days have been exploited in 2026?

Eight, including this one.

Source: The Hacker News