Google has issued emergency security patches for the Chrome desktop browser addressing nine vulnerabilities, including an actively exploited zero-day flaw.
The zero-day flaw is tracked as CVE-2026-125350, a high-severity use-after-free weakness located in Chrome's XML parsing component. The defect occurs when Chrome's XML parser deletes an object from system memory without clearing the pointer referencing it, which permits attackers to manipulate memory to run arbitrary code or crash the browser.
An anonymous security researcher reported the flaw to Google on November 6, 2026. In an advisory, Google stated, "Google is aware that an exploit for CVE-2026-125350 exists in the wild." The company has kept technical details and links restricted until a majority of users update their software. The identities of the actors carrying out the attacks remain unknown.
CVE-2026-125350 is the eighth zero-day vulnerability in Chrome patched after active exploitation during 2026, matching the eight exploited zero-days Google resolved in 2025.
How Desktop Users Can Update
Google has issued fixed desktop builds numbered 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. Users can install the patch immediately through the browser menu:
- Click More, select Help, and open About Google Chrome.
- Allow the browser to download the update and click Relaunch.
Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are advised to apply corresponding patches as vendors release them.
