Google Chrome 0-Day Exploited in the Wild for Remote Code Execution
Google has patched a critical use-after-free vulnerability in Chrome, CVE-2026-125350, which attackers were actively exploiting to execute malicious code remotely.
Google has rushed to patch a zero-day vulnerability affecting its popular Chrome browser, identified as CVE-2026-125350. This critical flaw, actively exploited in the wild by malicious actors, allowed remote attackers to execute arbitrary code on a victim's system.
The vulnerability is a use-after-free bug within Chrome's XML component. Such flaws occur when a program attempts to access memory that has already been deallocated, a condition that attackers can often leverage to crash applications or, more dangerously, to inject and execute their own malicious code. The exploit likely involves tricking users into visiting a specially crafted web page, potentially delivered via phishing emails, malicious advertisements, or compromised websites.
Google's security team confirmed that details about the vulnerability will remain restricted until a significant portion of users have applied the update, a standard practice to prevent further exploitation. The fix is included in the latest Stable channel release, pushing Chrome to version 157.0.8103.50/.51 for Windows and Mac users, and version 157.0.8103.50 for Linux.
This is not the first time Chrome has faced a zero-day exploit in recent memory. A similar incident occurred in June, where a zero-day vulnerability also allowed for remote code execution through a crafted web page, highlighting the persistent threat landscape for widely used browsers.
Beyond the headline CVE-2026-125350, the update addresses a total of nine security vulnerabilities. Seven of these are classified as High severity, including an uninitialized resource flaw in WebGL (CVE-2026-125345), an incorrect authorization issue in FileSystem (CVE-2026-125347), a buffer overflow in Compositing (CVE-2026-125343), an out-of-bounds write in the GPU component (CVE-2026-125348), and a type confusion vulnerability in the V8 JavaScript engine (CVE-2026-125344).
Additionally, the update patches a second use-after-free vulnerability in the XML component (CVE-2026-125346), reported by Arni Hardarson of Neonix Security. Two medium-severity vulnerabilities, both uninitialized resource bugs in the GPU component (CVE-2026-125349 and CVE-2026-125342), were also fixed, with one reported by Vo Duc Thang.
Google has also released the patch for enterprise users via the Extended Stable channel, which receives version 156.0.8078.96. While Chrome typically downloads updates automatically in the background, users will need to manually relaunch the browser to apply the fix. For Linux users, the update should be managed through their respective package managers. Users of other Chromium-based browsers are advised to monitor their vendors for similar patches, as they often share underlying code.
The discovery of this zero-day, reported by an anonymous researcher just three days before the patch was issued, underscores the ongoing cat-and-mouse game between vulnerability researchers, exploit developers, and browser vendors. Despite advanced security tools like AddressSanitizer and MemorySanitizer, sophisticated memory corruption bugs continue to slip through, necessitating rapid patching and user vigilance.
This update addresses CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component that was reported anonymously and is already being exploited in the wild. This marks the eighth zero-day vulnerability patched in Chrome this year, underscoring the persistent threat of active exploitation against the popular browser.