Google patches in-the-wild Chrome zero-day allowing remote code execution

Google shipped a Chrome update that closes CVE-2026-125350, a use-after-free in the browser's XML component that attackers are already exploiting for remote code execution. The company rated the flaw high severity and said it is aware of in-the-wild exploitation. An anonymous researcher reported the bug on November 6, 2026, three days before the patch landed.

The stable release brings Chrome to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux. The rollout will reach users over the coming days and weeks. Google's Chrome Security team said technical details stay private until most installations have the fix.

Google has not named the attackers or said how many people were hit. A use-after-free occurs when software keeps using memory after that memory has been released. An attacker can exploit the condition to crash the browser or run code, usually through a crafted page.

In total the update delivers nine security fixes, seven rated high severity. Besides the exploited XML bug, Google listed an uninitialized resource flaw in WebGL (CVE-2026-125345), an incorrect authorization issue in the file system component (CVE-2026-125347), a compositing buffer overflow (CVE-2026-125343), a GPU out-of-bounds write (CVE-2026-125348), and a type confusion in V8 (CVE-2026-125344). Arni Hardarson of Neonix Security reported a separate use-after-free in XML, CVE-2026-125346. Two medium-severity uninitialized resource bugs in the GPU were also fixed as CVE-2026-125349 and CVE-2026-125342.

CyberSecurityNews noted that browsers continuously handle untrusted content, so memory bugs in parts like XML are frequent targets. Opening a malicious link can be enough to trigger the flaw; attackers can deliver the link through phishing email, ads, or compromised websites.

The Extended Stable channel receives the zero-day fix in version 156.0.8078.96. Chrome downloads updates automatically, but the patch only takes effect after a restart. To restart, users can open the Chrome menu, choose Help, click About Google Chrome, and select Relaunch. Linux users should update through their package manager. People using Chromium-based browsers should watch for patches from their vendors because those browsers share Chrome's engine code.