Chrome zero-day whack-a-mole continues as 2026 tally hits 8

Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the entire previous year with nearly two months still remaining in the calendar. The most recent flaw, designated CVE-2026-125350, is a severe use-after-free vulnerability within Chrome's XML component. In a security advisory published on Monday, Google confirmed that attackers are currently exploiting the bug, but they have not disclosed the identity of the perpetrators or the targeted individuals.

Google is aware of an exploit being circulated in the wild for CVE-2026-125350, but they have provided limited information on the attacks. The vulnerability was reported anonymously on November 6 and stems from a memory management error that occurs when software continues to use a pointer to memory that has already been released.

Such bugs can potentially enable attackers to corrupt memory and execute malicious code, although Google has not disclosed the specifics of the exploitation method for this particular flaw. Google is withholding further technical details until a significant number of users have installed the patch, a common strategy aimed at preventing other attackers from obtaining a functional exploit.

The patch is available for Chrome versions 157.0.8103.50/.51 on Windows and macOS, and 157.0.8103.50 on Linux. In addition to addressing this high-severity issue, the update also resolves eight other security vulnerabilities, including high-severity flaws impacting WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine.

This second vulnerability, tracked as CVE-2026-125346, is also a use-after-free bug in Chrome's XML component, which was reported by Arni Hardarson of Neonix Security in October. However, Google has not indicated that this second flaw is currently being exploited. The discovery of this latest zero-day adds to an already extensive list of Chrome exploits this year.

By June, Google had already patched five actively exploited Chrome zero-days, including vulnerabilities in its V8 JavaScript engine, Skia graphics library, and WebGPU implementation. Since then, two more V8 bugs have been fixed in September, bringing the total to eight Chrome zero-days exploited in the wild, bringing 2026 level with 2025.

It remains uncertain whether Google will manage to avoid adding another zero-day to the list during the remaining weeks of the year. Google has stated that the latest update will be released over the coming days and weeks, but users can manually check for the fix by navigating to Chrome's Settings menu and selecting About Chrome.

With attackers already taking advantage of the vulnerability, it may be prudent for users to check for the update sooner rather than waiting for Chrome to initiate the process.