Google patches exploited Chrome zero-day CVE-2026-125350
Original title: Google patches eighth Chrome zero-day exploited in attacks this year
Stable builds 157.0.8103.50 and .51 fix a use-after-free in Chrome's XML parser; attack details stay restricted.
Google released emergency Stable Desktop updates after confirming an exploit for CVE-2026-125350 exists in the wild. The high-severity use-after-free is in Chrome's XML component and can be used to corrupt memory and run code. Fixed versions are 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux. Google has not described the attacks and may restrict bug details until most users update.
Unconfirmed: Google has not shared details of the in-the-wild exploitation.
- Google calls this the eighth Chrome zero-day exploited in attacks this year.
- The weakness occurs when the XML parser uses memory after freeing an object.
- The update may take days or weeks to reach every Chrome user.
- Google says it found evidence of exploitation but shared no incident details.
Impact: memory corruption that can lead to code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 on Windows and macOS; 157.0.8103.50 on Linux |
- 1.Update Chrome Stable to 157.0.8103.50 or 157.0.8103.51.
- CVEs
- CVE-2026-125350
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.