# Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day

Source: https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
Kiwi News: https://news.kiwistand.com/stories/Google-Issues-Chrome-Security-Update-for-Eighth-Actively-Exploited-Zero-Day?index=0x6af32050dfa5fa4d4281900eddf3c1f6032ecff66e0eb96756e3bc67743aba875f7d0b98
Submitted by misha on 2026-11-10 UTC, 2 upvotes, 0 comments

## Summary

Google released Chrome updates on Monday to patch nine security vulnerabilities, including CVE-2026-125350, a high-severity use-after-free bug in the XML component that is under active exploitation in the wild. An anonymous security researcher was credited with discovering and reporting the flaw on November 6, 2026. Google said it is aware that an exploit for the bug exists but has not disclosed how it is being abused or who is behind the attacks. With this update, Google has addressed eight actively exploited Chrome zero-days since the start of the year, and users are advised to update to version 157.0.8103.50 or later.

## Article

Vulnerability / Browser Security

Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.

The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.

Use-after-free bugs typically occur when a program attempts to access a memory location after it has already been freed. Successful exploitation of these vulnerabilities could allow an attacker to achieve data corruption, program crashes, or arbitrary code execution.

An anonymous security researcher has been credited with discovering and reporting the flaw on November 6, 2026.

Google acknowledged it is "aware that an exploit for CVE-2026-125350 exists in the wild," but has not revealed any additional specific information related to how it's being abused in real-world attacks or who is behind them.

"Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the tech giant added. "We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on, but haven't yet fixed."

With the latest development, Google has addressed a total of eight actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

For optimal protection, users are advised to update their Chrome browser to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux. To ensure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch.

Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.