GoKawiilGoogle fixes Chrome zero-day CVE-2026-125350, eighth exploited this year
Google issued an emergency security update for Chrome after confirming an exploit exists in the wild for CVE-2026-125350, a high-severity Use-After-Free vulnerability in the browser's XML component. The flaw allows attackers to manipulate freed memory to potentially execute malicious code. The fix is rolling out to Windows, macOS, and Linux users on the Stable Desktop channel.
GoKawiil's interpretation of the reporting above, not reported fact.
This marks the eighth actively exploited Chrome zero-day Google has patched this year, suggesting attackers continue to find and weaponize browser flaws at a steady pace. Google's decision to withhold technical details until most users update reflects standard practice to limit further exploitation while patches propagate.
- CVE-2026-125350 is a Use-After-Free flaw in Chrome's XML parser already being exploited.
- Fixes are available for Windows, macOS, and Linux via Chrome's automatic update mechanism.
- This is the eighth zero-day Google has patched in Chrome since the start of the year.
Source: bleepingcomputer.com, 2026-11-10
Published there as: “Google patches eighth Chrome zero-day exploited in attacks this year”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.