Google patches eighth actively exploited Chrome zero-day of 2026

Google released a Chrome security update on Monday, Nov. 9, 2026, patching nine vulnerabilities including an actively exploited zero-day in the browser’s XML component.

The zero-day, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome’s XML component. “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” An anonymous researcher reported CVE-2026-125350 to Google on Nov. 6, 2026, and Google shipped the fix on Nov. 9, 2026, three days after receiving the report. A use-after-free occurs when software accesses memory after releasing it, potentially causing crashes or code execution.

The patched desktop versions are Chrome 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and Chrome 157.0.8103.50 for Linux. The patched Android build is Chrome 157.0.8103.50, reaching phones through Google Play over the next few days. Google restricts bug details and links until most users have the fix, including for unfixed third-party libraries.

The release fixes nine vulnerabilities total, rated as seven high-severity and two medium-severity issues. The remaining high-severity issues include a second XML use-after-free, type confusion in V8, an out-of-bounds write in the GPU, a buffer overflow in Compositing, an authorization flaw in FileSystem, and an uninitialized resource bug in WebGL. The two medium-severity bugs are uninitialized resource issues in the GPU component, tracked as CVE-2026-125349 and CVE-2026-125342. Google discovered most of the nine flaws internally.

CVE-2026-125350 is the eighth actively exploited Chrome zero-day addressed since the start of 2026. The previous seven actively exploited Chrome zero-days in 2026 are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. Google fixed eight additional actively exploited Chrome zero-days in 2025, many reported by its Threat Analysis Group.

CVE-2026-85046, fixed in September 2026, is a V8 type confusion bug with CVSS score 8.8. Salvatore Gulizia reported CVE-2026-85046 on Aug. 4, 2026, and received a $1,000 bug bounty. It was the sixth Chrome zero-day fixed in 2026 as of Sept. 4, 2026.

Google has not disclosed who is behind the attacks, how they work, who was targeted, or which platform was hit. The CVSS score for CVE-2026-125350 is N/A. CISA has not added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog.

CVE-2026-125346 is a second XML use-after-free reported by Arni Hardarson of Neonix Security on Oct. 12, 2026. Google has not linked CVE-2026-125346 to the actively exploited CVE-2026-125350. A Chromium patch tied to CVE-2026-125350 involves libxslt and its pattern-matching cache for nested XML evaluation.

HKCERT rates the Chrome 157 bulletin as high risk due to the in-the-wild exploit. HKCERT says possible impacts are denial of service, security restriction bypass, and remote code execution.

Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should apply fixes when available.

Android users should check their Chrome version and update manually through Google Play rather than waiting for the staged rollout. Users should also confirm their phone has the November 2026 Android security patch while updating Chrome. Google states Android releases get identical security fixes to matching desktop builds unless otherwise noted. Google’s Android release notes for Chrome 157 mention only stability and performance improvements.

Chrome automatically installs updates after the next launch if users do not update manually. A downloaded update does not protect an already-running browser until it restarts. Google said the rollout to all Chrome users might take days or weeks. Organizations should verify installed browser versions on managed endpoints instead of assuming the staged rollout protected every device.