Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026: Update Your Browser Now to Block Attacks |
MOUNTAIN VIEW, Calif. — Google has released an emergency security update for its Chrome web browser to fix a high-severity vulnerability that attackers are already exploiting. It is the eighth such zero-day flaw the company has patched this year.
The vulnerability, tracked as CVE-2026-125350, affects Chrome on Windows, macOS, Linux and Android. Google released the fix on Monday, Nov. 9, and is urging users to update immediately.
"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a security advisory.
A zero-day is a vulnerability that attackers exploit before a fix is available or before the developer is aware of it.
The bug is a "use-after-free" vulnerability in Chrome's XML component, which processes a common data format used on websites.
Use-after-free flaws occur when a program keeps using a piece of memory after it has been freed.........