Google patches eighth Chrome zero-day exploited this year

Google has released security updates for a Chrome vulnerability that attackers have exploited in the wild. The company said it was aware of an exploit for CVE-2026-125350.

The flaw is a high-severity use-after-free vulnerability in Chrome’s XML component. It can occur when the browser’s XML parser processes data and deletes an object from memory without clearing the pointer to it. An attacker may then exploit the freed memory to manipulate memory and execute malicious code.

Google has not shared details about the observed attacks. It said access to information about the bug may remain restricted until most users have installed a fix, and restrictions may continue if a third-party library used by other projects remains unpatched.

The fix is rolling out through Chrome’s Stable Desktop channel for Windows, macOS and Linux. The listed versions are 157.0.8103.50 and 157.0.8103.51 for macOS, and 157.0.8103.50 for Linux. Google said the update could take days or weeks to reach all users. BleepingComputer reported that it was available immediately when the publication checked for updates.

Google said it has addressed seven other zero-day vulnerabilities exploited in attacks since the start of the year, making this the eighth such flaw.