> Chrome zero-day whack-a-mole continues as 2026 tally hits 8

Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still left on the calendar. The latest flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome's XML component. Google confirmed in a security advisory published Monday that attackers are already exploiting the bug, although it hasn't said who's behind the attacks or who might be getting targeted. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said, offering little else about the attacks. The vulnerability was reported anonymously on November 6 and involves a memory management error that occurs when software continues using a pointer to memory that has already been freed. Such bugs can potentially allow attackers to corrupt memory and execute malicious code, although Google hasn't disclosed how this particular flaw is being exploited. Google is keeping further technical details under wraps until enough users have installed the fix, a familiar approach intended to stop other attackers from getting their hands on a working exploit. The patch arrives in Chrome 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. The update also addresses eight other security vulnerabilities, including high-severity flaws affecting WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine. The release fixes another use-after-free bug in Chrome's XML component, CVE-2026-125346, which was reported by Arni Hardarson of Neonix Security in October, though Google hasn't indicated that this second vulnerability is being exploited. The latest discovery adds to what's becoming a rather long list of Chrome zero-days this year. By June, Google had already patched five actively exploited Chrome zero-days, including flaws in its V8 JavaScript engine, Skia graphics library, and WebGPU implementation. The list has only grown since then, with two more V8 bugs fixed in September and the latest XML vulnerability bringing the total to eight. That puts 2026 level with 2025, when Google also fixed eight Chrome zero-days exploited in the wild. Whether the browser maker can make it through the remaining weeks of the year without adding another to the pile is anyone's guess. Google says the latest update will roll out over the coming days and weeks, but users can check manually by heading to Chrome's Settings menu and selecting About Chrome. With attackers already making use of the vulnerability, it's probably worth doing that sooner rather than waiting for Chrome to get around to it. ®