Google released updates on Monday to fix nine security vulnerabilities, including one that is being actively exploited in the wild.
The high severity vulnerability, assigned to CVE identifier CVE-2026-125350 (CVSS score: N/A), was described as a use-after-free bug in the XML component.
Use-after-free bugs typically occur when a program attempts to access a memory location after it has already been freed. Successful exploitation of these vulnerabilities could allow an attacker to corrupt data, crash programs, or execute arbitrary code.
An anonymous security researcher was credited with discovering and reporting the flaw on November 6, 2026.
Google acknowledged that it is “aware that an exploit for CVE-2026-125350 exists in the wild” but has not revealed any additional specific information about how it is used in real-world attacks or who is behind them.
“Access to bug details and links may be restricted until a majority of users are updated with a fix,” the tech giant added. “We will also keep restrictions if the bug exists in a third-party library that other projects also depend on, but which has not yet been fixed.”
With the latest development, Google has resolved a total of eight actively exploited Chrome Zero Days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.
For optimal protection, users are advised to update their Chrome browser to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux. To ensure the latest updates are installed, users can go to More > Help > About Google Chrome and select Relaunch.
Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply patches as soon as they become available.
Gn tech
