Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026

Live updates

1. 1h ago

   Google Issues Chrome Update for Eighth Zero-Day of 2026

   Google released a security update for Google Chrome addressing the eighth actively exploited zero-day vulnerability of 2026. The flaw, designated as CVE-2026-125350, is a use-after-free vulnerability located in XML. Cybersecurity reporting indicates that an exploit exists in the wild, allowing attackers to execute malicious code remotely through crafted webpages. The Cybersecurity and Infrastructure Security Agency added the Chromium XML flaw to its Known Exploited Vulnerabilities catalog. Users on Windows, macOS, and Linux are urged to apply the patches immediately to secure their browsers against ongoing attacks.

   Why it matters

   Zero-day vulnerabilities targeted in real-world attacks pose severe risks because malicious actors leverage them before a vendor can issue a defensive patch. Browser vulnerabilities of this nature frequently enable remote code execution, granting attackers unauthorized access or control over an affected system. Security agencies monitor these active exploits closely to protect enterprise and consumer infrastructure from compromise.

   What is confirmed

   • Google issued a Chrome security update addressing the eighth actively exploited zero-day of 2026.
   • The vulnerability is tracked as CVE-2026-125350 and involves a use-after-free defect in XML.
   • CISA added the actively exploited Chromium XML flaw to its Known Exploited Vulnerabilities catalog.
   • The stable channel update introduces version 157 for Windows, macOS, and Linux.

   What to watch next

   • Further advisories from security agencies regarding active exploitation patterns for CVE-2026-125350
   • Adoption rates of the newly released Chrome patches across enterprise networks
   Sources used for this update (13)

   1. chromereleases.googleblog.com — Chrome Releases
   2. thehackernews.com — The Hacker News | #1 Trusted Source for Cybersecurity News
   3. www.nbcnews.com — Tracking the 2026 early vote
   4. 1023jack.com — Anthropic Could Go Public With A “Junk” Credit Rating. What That Means, And What Is Actually Confirmed
   5. www.hitech.co.kr — Twelve Hours to Open Anthropic’s Door: How Far Did the Researchers Get?
   6. www.bitdefender.com — FBI blames North Korea for $6.3 billion Binance hack
   7. The Hacker News — Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
   8. Hong Kong Computer Emergency Response Team Coordination Centre — Google Chrome Multiple Vulnerabilities
   9. CyberSecurityNews — Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely
   10. PCWorld — Chrome 157 fixes over 200 security flaws, 7 of them critical
   11. Rescana — Google Chrome CVE-2026-125350: Use-After-Free in XML, Exploit Exists in the Wild — Patch Now
   12. cybersecuritynews.com — CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks
   confidence 100%