Chrome hit by 8th zero-day exploit this year, Google rushes security update

Beating AI News Flash: Google urgently releases Chrome security update, fixing 9 vulnerabilities at once. One high-severity zero-day vulnerability has already been exploited in real attacks. This is also Chrome's 8th confirmed zero-day vulnerability exploited in the wild this year.

The vulnerability is tracked as CVE-2026-125350, located in Chrome's XML component, and is a "use-after-free" (UAF) memory vulnerability. Simply put, the browser frees a block of memory but still attempts to access it. Attackers could use this to corrupt memory and, in severe cases, even execute malicious code.

The vulnerability was reported by an anonymous security researcher on November 6. Google only confirmed that an exploit has appeared in real-world environments, and has not yet disclosed the attacker's identity, targeted victims, or specific attack methods, nor has it confirmed whether the attack successfully executed malicious code.

Google has temporarily restricted the public disclosure of technical details of the vulnerability to prevent attackers from using this information to launch more attacks before a large number of users complete updates.

Currently, Windows and macOS users should update to Chrome 157.0.8103.50 or .51, and Linux and Android users should update to 157.0.8103.50. Open Chrome "Settings → About Chrome" to check for updates, and restart the browser after installation. Users of Chromium-based browsers such as Edge and Brave should also pay attention to the corresponding vendors' security patches.