Google Chrome Zero-Day Vulnerability CVE-2026-125350 Exploited in the Wild

Google has released an emergency security update for its Chrome web browser after confirming that a high-severity vulnerability, tracked as CVE-2026-125350, is being actively exploited in the wild.

The vulnerability is a use-after-free memory handling flaw in Chrome’s XML component and could allow remote attackers to execute arbitrary code within the browser’s security sandbox by tricking victims into opening a specially crafted HTML page.

Google confirmed that an exploit for the vulnerability exists in the wild, prompting the release of an out-of-band security update on 9 November 2026. The flaw has been rated High severity, with a CVSS 3.1 score of 8.8.

A use-after-free vulnerability occurs when software continues attempting to access a section of computer memory after it has already been released. Attackers can potentially exploit this condition to corrupt memory, manipulate application behaviour and execute malicious code.

In this case, attackers could potentially deliver a specially crafted webpage through phishing links, malicious advertisements or compromised websites. Once the victim visits the page, Chrome’s XML processing functionality can be triggered, potentially allowing malicious code to execute within the browser sandbox.

Although the sandbox provides an additional layer of protection by restricting what code can access, successful exploitation could still present a significant security risk, particularly if combined with other vulnerabilities that allow attackers to escape the browser’s security restrictions.

Nine security vulnerabilities addressed

The emergency update also addresses eight additional security vulnerabilities affecting different Chrome components. These include:

• CVE-2026-125346 – Use-after-free vulnerability in XML.
• CVE-2026-125344 – Type confusion vulnerability in V8.
• CVE-2026-125348 – Out-of-bounds write in GPU.
• CVE-2026-125347 – Incorrect authorisation in FileSystem.
• CVE-2026-125343 – Buffer overflow in Compositing.
• CVE-2026-125345 – Uninitialised resource vulnerability in WebGL.
• CVE-2026-125349 – Uninitialised resource in GPU.
• CVE-2026-125342 – Uninitialised resource in GPU.

Seven of the nine vulnerabilities addressed in the release have been classified as High severity.

The vulnerability has also been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalogue, confirming that it represents a known security threat requiring remediation.

Affected versions and security updates

Google has released updated Chrome versions to address the vulnerability across supported desktop platforms.

The following versions contain the security fix:

• Windows: Chrome 157.0.8103.51
• macOS: Chrome 157.0.8103.51
• Linux: Chrome 157.0.8103.50
• Chrome Extended Stable: 156.0.8078.96

Users running earlier vulnerable versions should update as soon as possible.

Administrators should also check other Chromium-based browsers, including Microsoft Edge, Opera, Brave and Vivaldi, and install the relevant vendor updates when available.

Google recommends users check for updates through Chrome’s built-in update mechanism by navigating to:

Settings → About Google Chrome.

The browser should download the latest available update automatically, although a restart is required before the security fixes become active.

With confirmation that CVE-2026-125350 is already being exploited, organisations and individual users should prioritise updating their browsers rather than waiting for their normal maintenance schedules.