Google has pushed out an emergency Chrome update after confirming that a previously unknown vulnerability in the browser is already being exploited by attackers in real-world attacks. The flaw, tracked as CVE-2026-125350, is a high-severity use-after-free bug sitting inside Chrome’s XML component, and Google says it has evidence an exploit for it exists in the wild.

The fix arrives in Chrome’s Stable channel as version 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux, with the rollout reaching users gradually “over the coming days and weeks.” As is standard practice for actively exploited bugs, Google is withholding technical specifics about the flaw until the patch has reached the majority of its user base, limiting the window for copycat attackers to reverse-engineer an exploit before most people are protected.

A Classic Memory Corruption Bug With Real-World Impact

Use-after-free vulnerabilities occur when a program continues to reference a piece of memory after it has already been freed up for other use. In a browser context, that kind of bug can often be weaponized to crash a tab or, in more severe cases, hijack the program’s execution flow to run attacker-controlled code — frequently triggered simply by a victim visiting a malicious or compromised web page.

Notably, an anonymous researcher reported the Chrome flaw to Google on November 6, 2026 — just three days before the patch went out, underscoring how quickly the Chrome Security team moved once in-the-wild exploitation was confirmed. Google has not disclosed who is behind the exploitation or how broadly it has been used, which is typical for zero-day disclosures still under active investigation.

Eight Additional Fixes, Most Rated High Severity

The zero-day patch wasn’t the only fix in this release. In total, the update resolves nine security issues, seven of which carry a High severity rating. Among them:

• An uninitialized resource issue in WebGL (CVE-2026-125345)
• Incorrect authorization logic in the FileSystem API (CVE-2026-125347)
• A buffer overflow in the Compositing engine (CVE-2026-125343)
• An out-of-bounds write bug in the GPU process (CVE-2026-125348)
• A type confusion flaw in the V8 JavaScript engine (CVE-2026-125344)
• A second use-after-free bug in XML handling (CVE-2026-125346), credited to researcher Arni Hardarson of Neonix Security

Two additional Medium-severity uninitialized resource bugs in the GPU process, CVE-2026-125349 and CVE-2026-125342, round out the list. Most of the fixes outside the zero-day itself were identified by Google’s internal security teams, who continue to run extensive fuzzing and code-audit programs against the browser’s most exposed components.

Why Browser Memory Bugs Keep Showing Up

Chrome’s attack surface is enormous by design — it is built to parse and render almost any content thrown at it, from XML and WebGL graphics to complex scripting through V8. That makes memory-handling components like XML parsing a recurring target for exploit developers, since a single corrupted pointer can sometimes be chained into full code execution. Delivery for this kind of bug is typically straightforward for attackers: a phishing email with a malicious link, a compromised advertising network, or a booby-trapped website are all common vectors, since the victim often only needs to load a single page.

This is not an isolated incident for Chrome in 2026. An earlier zero-day patched back in June also enabled remote code execution via a specially crafted web page, and the broader Chrome 157 release that preceded this patch by only a few days fixed 213 separate security issues, seven of them Critical. The frequency of these disclosures reflects both the intensity of researcher and attacker interest in the world’s most widely used browser and Google’s continued investment in rapid patch turnaround.

What Chrome Users Should Do

Enterprise users are also covered: the Extended Stable channel, used by many organizations that delay rolling out updates, receives the same zero-day fix in version 156.0.8078.96. Because Chrome typically updates automatically in the background, most users will receive the patch without taking any action — but security teams managing fleets of devices should confirm the update has been applied, particularly given active exploitation.

To check manually, users can navigate to Chrome’s menu, select “Help,” then “About Google Chrome,” which will prompt an update check and display the current version number. A full restart of the browser is required for the patch to take effect.