Google fixes the eighth actively exploited Chrome zero-day of 2026

Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild.

Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild.

The vulnerability is a use after free issue that resides in XML and was reported by an anonymous source on November 6, 2026..

“Google is aware that an exploit for CVE-2026-125350 exists in the wild.” reads the advisory.

A Use-after-free (UAF) is a memory corruption vulnerability that occurs when a program continues to use a piece of memory after it has been released (freed).

In simple terms, an application allocates memory to store data, then releases that memory when it is no longer needed. A use-after-free bug occurs when the application later tries to access that same memory location, even though it is no longer valid.

Attackers may exploit a use-after-free vulnerability to crash an application and cause a denial-of-service condition, corrupt memory, or, under certain conditions, execute arbitrary code. Depending on the affected component and the nature of the flaw, successful exploitation could also allow attackers to escalate their privileges.

The IT giant has not shared further details about how attackers are exploiting the vulnerability or who is behind the attacks.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.” continues the advisory.

CVE-2026-125350 is the eighth exploited Chrome zero-day of 2026. Since the start of the year, Google has addressed the following zero-day flaws exploited in attacks in the wild:

• February 2026 – CVE-2026-2441 (CVSS score: 8.8) – Use after free in CSS.
• March 2026 – CVE-2026-3909 (CVSS score: 8.8) – Out-of-bounds write in the Skia 2D graphics library and CVE-2026-3910 (CVSS score: 8.8) – Flaw in the implementation of the V8 JavaScript/WebAssembly engine.
• April 2026 – CVE-2026-5281 (CVSS score: 8.8) – Use-after-free bug in Dawn, the WebGPU component used for graphics processing.
• June 2026 – CVE-2026-11645 (CVSS score: 8.8) – Out-of-bounds memory access in the V8 JavaScript engine
• September 2026 – CVE-2026-85046 (CVSS score: 8.8) – V8 type confusion flaw.
• September 2026 – CVE-2026-87491  (CVSS score of 8.8) – Out of bounds write in V8.

Google has released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The update will roll out gradually over the coming days and weeks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)