Google on Monday informed Chrome users of new security updates that patch nine vulnerabilities, including a zero-day exploited in the wild.
The exploited vulnerability, tracked as CVE-2026-125350 and rated high severity, is a use-after-free in the web browser’s XML component.
A researcher who wants to remain anonymous reported the issue to Google on November 6.
The tech giant has not shared any additional details, and no information appears to be available on the attacks exploiting CVE-2026-125350.
CISA has yet to add CVE-2026-125350 to its Known Exploited Vulnerabilities (KEV) catalog.
This is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.
In addition to the zero-day, the latest Chrome updates patch six high-severity vulnerabilities in the WebGL, FileSystem, Compositing, GPU, V8, and XML components. Google discovered most of the flaws internally.
Two medium-severity bugs described as uninitialized resource issues in the GPU component have also been fixed.
The patches are included in Chrome 157 updates, specifically versions 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux.
Related: Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Related: Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Related: Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
