Google has issued an emergency security update for Chrome to address a newly discovered vulnerability that attackers have already exploited in the wild. The flaw, tracked as CVE-2026-125350, is the eighth Chrome zero-day exploited in attacks since the beginning of the year. Google confirmed in a Monday security advisory that it is aware an exploit for the vulnerability exists.
The bug is a use-after-free weakness in Chrome's XML component. According to Google, the issue occurs when the browser's XML parser processes data, removes an object from the computer's memory, but leaves behind a pointer that still references that object. The flaw is rated high severity as a memory corruption vulnerability. Attackers can take advantage of the leftover reference when the browser later tries to read or use the freed memory space, allowing them to manipulate the memory layout and run malicious code.
Google has not disclosed further information about the attacks that used the flaw. The company said access to bug details and links may remain restricted until most users have received the fix. It also said restrictions will stay in place if the bug exists in a third-party library that other projects depend on and have not yet patched.
The fix is available for users on the Stable Desktop channel. New versions are rolling out to Windows and macOS at 157.0.8103.50 and .51, and to Linux at 157.0.8103.50. Google cautioned that the update could take days or weeks to reach every Chrome user, though it was available immediately when BleepingComputer checked for updates. Users who prefer not to update manually can let Chrome check on its own, since the browser installs updates automatically after its next launch.
The disclosure adds to a steady run of actively exploited Chrome flaws this year. Google has now patched seven other zero-day vulnerabilities that were exploited in attacks since the start of the year. In 2025, the company fixed eight more zero-days used in attacks, many of them reported by its Threat Analysis Group, which tracks zero-day exploits deployed in spyware campaigns.
More cybersecurity news from TechManNews.
