Chrome zero-day whack-a-mole continues as 2026 tally hits 8

Google has actually covered its 8th actively made use of Chrome zero-day of 2026, matching its overall for the entire of in 2015 with almost 2 months still left on the calendar.

The current defect, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome’s XML element. Google verified in a security advisory released Monday that assaulters are currently making use of the bug, although it hasn’t stated who’s behind the attacks or who may be getting targeted.

“Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the business stated, using little else about the attacks.

The vulnerability was reported anonymously on November 6 and includes a memory management mistake that happens when software application continues utilizing a guideline to memory that has actually currently been released. Such bugs can possibly enable opponents to corrupt memory and carry out destructive code, although Google hasn’t divulged how this specific defect is being made use of.

Google is keeping even more technical information under covers till adequate users have actually set up the repair, a familiar method meant to stop other enemies from getting their hands on a working make use of.

The spot gets here in Chrome 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. The upgrade likewise addresses 8 other security vulnerabilities, consisting of high-severity defects impacting WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine.

The release repairs another use-after-free bug in Chrome’s XML part, CVE-2026-125346, which was reported by Arni Hardarson of Neonix Security in October, though Google hasn’t suggested that this 2nd vulnerability is being made use of.

The most recent discovery contributes to what’s ending up being a rather long list of Chrome zero-days this year. By June, Google had actually currently covered 5 actively made use of Chrome zero-days, consisting of defects in its V8 JavaScript engine, Skia graphics library, and WebGPU application. The list has actually just grown ever since, with 2 more V8 bugs repaired in September and the current XML vulnerability bringing the overall to 8.

That puts 2026 level with 2025, when Google likewise repaired 8 Chrome zero-days made use of in the wild. Whether the internet browser maker can make it through the staying weeks of the year without including another to the stack is anybody’s guess.

Google states the most recent upgrade will present over the coming days and weeks, however users can examine by hand by heading to Chrome’s Settings menu and choosing About Chrome. With assailants currently using the vulnerability, it’s most likely worth doing that quicker instead of awaiting Chrome to navigate to it. ®