Google has released an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. In its release notes Google says it “is aware that an exploit for CVE-2026-125350 exists in the wild,” which makes it the eighth Chrome zero-day exploited in attacks so far in 2026. Google has not said who is using it or how.
A use-after-free happens when a program keeps using a piece of memory after it has been released. If an attacker can control what ends up in that memory, the bug can cause crashes or let them run code. Google’s release notes credit an anonymous researcher, who reported the flaw on November 6, 2026. The same update fixes eight other bugs (nine security fixes in total), including a separate XML use-after-free, CVE-2026-125346, which Google does not flag as exploited. Google says details may stay restricted until most users have updated.
This follows the seventh zero-day, which we covered in Update Chrome Now: Seventh Zero-Day CVE-2026-87491 Exploited.
How to check if you’re affected
Affected versions are desktop Chrome versions before 157.0.8103.50 (Linux) or before 157.0.8103.50/.51 (Windows and macOS). Open the Chrome menu, go to Help > About Google Chrome, let it check for the update, and select Relaunch; the version shown should be 157.0.8103.50 or later. Google says the rollout may take days or weeks to reach everyone, but BleepingComputer found the update available immediately when it checked.
The Hacker News also advises users of other Chromium-based browsers, such as Edge, Brave, Opera and Vivaldi, to apply the fixes once those vendors release them. Neither source says whether Chrome on Android or iOS is affected, so check your mobile browser’s update page as usual.