Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026: Update Your Browser Now to Block Attacks

MOUNTAIN VIEW, Calif. — Google has released an emergency security update for its Chrome web browser to fix a high-severity vulnerability that attackers are already exploiting. It is the eighth such zero-day flaw the company has patched this year.

The vulnerability, tracked as CVE-2026-125350, affects Chrome on Windows, macOS, Linux and Android. Google released the fix on Monday, Nov. 9, and is urging users to update immediately.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a security advisory.

A zero-day is a vulnerability that attackers exploit before a fix is available or before the developer is aware of it.

What the flaw does

The bug is a "use-after-free" vulnerability in Chrome's XML component, which processes a common data format used on websites.

Use-after-free flaws occur when a program keeps using a piece of memory after it has been freed. Attackers can exploit that mistake to manipulate the browser's memory and run malicious code. In this case, an attacker could potentially take advantage of the flaw by tricking a user into visiting a specially crafted web page.

An anonymous security researcher reported the vulnerability to Google on Nov. 6, just three days before the patch was released.

Google did not disclose details of the attacks or say who was behind them. The company said it was restricting access to technical details until most users receive the fix, a common practice designed to prevent other hackers from copying the exploit.

Which versions are safe

The fix is included in Chrome 157.0.8103.50 or 157.0.8103.51 for Windows and Mac, and 157.0.8103.50 for Linux. Google also released Chrome 157.0.8103.50 for Android, which contains the same security fixes. The update will roll out over the coming days and weeks.

The update addresses nine security vulnerabilities in total. They include: a second use-after-free flaw in the XML component, reported by Arni Hardarson of Neonix Security a type confusion bug in Chrome's V8 JavaScript engine flaws in WebGL, the GPU process, FileSystem and Compositing.

Eighth zero-day this year

The flaw is the eighth Chrome zero-day exploited in attacks and patched since the start of 2026. Earlier ones included: an iterator invalidation flaw in CSSFontFeatureValuesMap, fixed in mid-February a use-after-free bug in Dawn, Chrome's WebGPU implementation, patched in April an out-of-bounds read and write flaw in the V8 engine, fixed in June the previous zero-day, an out-of-bounds write in V8, patched in September.

Google also fixed eight Chrome zero-days exploited in attacks in 2025. The steady stream reflects how heavily attackers target the world's most popular browser, which is used by billions of people.

The U.S. Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalog, according to the security firm Qualys. The listing requires federal agencies to patch by Nov. 24. Some earlier reports said the flaw had not yet been added to the list.

How to update Chrome

Chrome usually updates automatically, but the fix takes effect only after the browser restarts. To check: 1. Open Chrome and click the three-dot menu in the top-right corner. 2. Go to Help, then About Google Chrome. 3. Chrome will check for updates and download the latest version. 4. Click Relaunch to finish installing the update.

On Android, users can update Chrome through the Google Play Store.

Users of other browsers built on Google's Chromium code, such as Microsoft Edge, Brave and Opera, should also watch for updates. Those browsers often share the same underlying vulnerabilities.