Google patches Chrome zero day exploited in the wild

Google has issued Chrome 157.0.8103.50 and 157.0.8103.51 to address a set of nine security bugs, including a Chrome zero-day exploited in the wild: CVE-2026-125350, described as a use-after-free in the browser’s XML component. The flaw is acknowledged by Google as an exploit that “exists in the wild,” with the vulnerability reported by an anonymous researcher on 6 November 2026 and the fix released a few days later.

The advisory notes that access to further details may be restricted until a majority of users have updated, and does not disclose the attackers or their targets.

In addition to CVE-2026-125350, the Chrome update patches CVE-2026-125346 (another XML use-after-free) and CVE-2026-125344 (a type confusion in the V8 engine). The release also fixes a Compositing buffer overflow, a GPU out-of-bounds write, a FileSystem authorization flaw, and three uninitialized resource bugs in WebGL and GPU code; Google states it has not confirmed exploitation for these eight other flaws. Affected versions run Chrome for Windows and macOS prior to 157.0.8103.50/51, and Chrome for Linux prior to 157.0.8103.50.

Users are advised to update by opening Settings, About Chrome, and applying the update, then relaunching the browser. Google’s Stable channel notes that rollout may take days or weeks, so users of Edge, Brave, Opera and other Chromium-based browsers should monitor for their own fixes. The article attributes the discovery and disclosure to an anonymous researcher, with Google’s confirmation of the exploit in the wild and the patch timetable as stated in its advisory.