Google has rushed out a fix for a zero-day vulnerability in Chrome that’s actively being exploited. Dubbed CVE-2026-125350, the flaw allows remote attackers to execute arbitrary code via Chrome’s XML component on Windows, Mac, and Linux systems.
What’s the Vulnerability?
The issue is a use-after-free bug in Chrome’s XML parsing engine—this type of vulnerability occurs when a program continues to use memory after it’s been freed. The risk: attackers can craft malicious web pages or links, exploit the flaw, and potentially run their own code on a user’s machine. Google confirmed that an exploit exists in the wild, and learned of the flaw through a report submitted on November 6, 2026—just three days before the patch began rolling out. Release channels are being updated to Chrome 157.0.8103.50/.51 (Windows & Mac) and 157.0.8103.50 (Linux). This fix will arrive over coming days. The Extended Stable channel will get it at version 156.0.8078.96 for enterprise users.
Other Vulnerabilities in the Update
This patch isn’t limited to the zero-day. In total, nine security flaws are addressed, seven rated High severity. Among them:
- An uninitialized resource issue in WebGL (CVE-2026-125345)
- An incorrect authorization problem in the FileSystem API (CVE-2026-125347)
- A buffer overflow in Compositing (CVE-2026-125343)
- An out-of-bounds write in GPU (CVE-2026-125348)
- Type confusion in Chrome’s V8 engine (CVE-2026-125344)
- A second use-after-free in XML (CVE-2026-125346), reported earlier
- Two medium-severity flaws in the GPU, both uninitialized resource bugs (CVE-2026-125349, CVE-2026-125342)
Most of these were discovered by external researchers; some were found internally. Details beyond what Google has shared remain under lock to protect users until the update reaches broad deployment.
How to Stay Protected
Chrome updates automatically, but users must restart the browser to apply fixes. On Windows and Mac, head to the Help section under the menu, select About Google Chrome, and hit Relaunch when prompted. Linux users should update via their package managers. For chromium-based browsers, patches may arrive separately—watch vendor notices closely.
Google points out that tools like AddressSanitizer, MemorySanitizer, Control Flow Integrity, and libFuzzer typically catch memory safety bugs early in development. This zero-day demonstrates that despite those layers of protection, critical vulnerabilities can still slip into the stable releases.
Analytical View: This event underscores a recurring tension in software security: even with modern fuzzing and memory safety tools, high-risk bugs can emerge after wide release. The pace at which this zero-day was reported, identified, and patched is encouraging—but the existence of such a flaw being exploited in the wild drives home how vigilant both vendors and users must remain. Organizations reliant on Chromium engines should assess their update policies and threat intelligence feeds; end users need to prioritize restarts and updates. The takeaway: in cybersecurity, no system is invulnerable, and rapid response matters.
