Chrome Zero-Day Tally Hits Eight for 2026 with Latest XML Vulnerability

Google has rushed out an update for its ubiquitous Chrome browser to address its eighth actively exploited zero-day vulnerability of 2026, a tally that now matches the total number of such flaws patched throughout the entirety of last year. The newly patched vulnerability, designated CVE-2026-125350, is a high-severity use-after-free bug residing within Chrome's XML component. Google confirmed in a security advisory that attackers are already weaponizing this flaw in the wild, though the company has not yet disclosed the identities of the threat actors or the specific targets of these attacks.

The vulnerability was reported anonymously on November 6 and stems from a memory management error where the software attempts to access memory that has already been deallocated. Such flaws can be exploited by attackers to corrupt memory and potentially execute arbitrary code on a victim's system. Google has opted to withhold detailed technical information about the exploit until a sufficient number of users have applied the patch, a standard practice aimed at preventing other malicious actors from leveraging the vulnerability.

The fix is available in Chrome versions 157.0.8103.50 and 157.0.8103.51 for Windows and macOS users, and version 157.0.8103.50 for Linux. This critical update also bundles fixes for eight additional security vulnerabilities, including several high-severity issues affecting components such as WebGL, FileSystem, the GPU, Compositing, and the V8 JavaScript engine.

Notably, the update also addresses CVE-2026-125346, another use-after-free vulnerability within Chrome's XML component. This second flaw was reported by Arni Hardarson of Neonix Security in October. However, Google has not indicated that CVE-2026-125346 is also being actively exploited.

The emergence of CVE-2026-125350 adds to a growing list of zero-day exploits targeting Chrome this year. By mid-2026, Google had already patched five zero-days that were being actively exploited, impacting components like the V8 JavaScript engine, the Skia graphics library, and WebGPU. The subsequent fixes for two more V8 bugs in September, followed by this latest XML vulnerability, bring the total number of exploited zero-days to eight.

This year's count of eight exploited zero-days matches the total recorded for 2025, raising concerns about the increasing pace of sophisticated attacks against widely used software. It remains to be seen whether Google can prevent further zero-day exploits from being discovered and weaponized before the end of the year.

Google advises users to update their Chrome browsers as soon as possible. The update will roll out automatically over the coming days and weeks, but users can manually check for and install the latest version by navigating to Chrome's Settings menu and selecting 'About Chrome'. Given the active exploitation, proactive updating is strongly recommended.