Google Chrome Zero-Day Vulnerability Actively Exploited to Execute Malicious Code
Google has released an urgent security update for its Chrome browser after confirming that attackers are exploiting a high-severity zero-day vulnerability in the wild. The vulnerability, tracked as CVE-2026-125350, could allow remote attackers to execute malicious code through the browser.
The security flaw affects Chrome's XML component and has been classified as a use-after-free vulnerability. Google acknowledged active exploitation in its November 9, 2026 security advisory and released updated browser versions to address the issue.
Understanding the CVE-2026-125350 Vulnerability
CVE-2026-125350 is a memory-management vulnerability caused by a use-after-free condition.
This type of flaw occurs when software continues to access a memory location after the memory has already been released. If attackers successfully manipulate this condition, they may be able to corrupt browser memory and execute unauthorised code.
Because Chrome processes content from websites and other online sources, vulnerabilities in its internal components can create opportunities for attackers to target users through malicious web content.
Google has confirmed that an exploit for this vulnerability exists in the wild. However, it has not disclosed the identity of the attackers, the number of affected users or the specific campaigns involved.
Google Releases Emergency Chrome Security Update
Google's November 9 Stable Channel update addresses nine security vulnerabilities, including CVE-2026-125350.
The patched versions are:
Windows: Chrome 157.0.8103.50 or 157.0.8103.51
macOS: Chrome 157.0.8103.50 or 157.0.8103.51
Linux: Chrome 157.0.8103.50
Extended Stable: Chrome 156.0.8078.96 for Windows and macOS
Google stated that the update will roll out over the coming days and weeks. The company is also restricting access to detailed vulnerability information until a majority of users have installed the security fix.
Nine Security Vulnerabilities Addressed
Alongside the actively exploited zero-day, the update includes eight additional security fixes.
Seven of the nine vulnerabilities are rated High severity, affecting components such as XML, WebGL, FileSystem, Compositing, GPU and V8.
The additional issues include memory-management weaknesses, incorrect authorisation, buffer overflow and type-confusion vulnerabilities.
The update demonstrates the importance of maintaining browser security across multiple internal components, particularly those responsible for processing web content and executing scripts.
How Users Can Protect Their Systems
Google recommends updating Chrome to the latest available version. Users can manually check for the update by following these steps:
Open Google Chrome.
Select the three-dot menu in the upper-right corner.
Navigate to Help → About Google Chrome.
Allow Chrome to check for and install available updates.
Select Relaunch to complete the installation.
Enterprise administrators should also ensure that managed browser installations receive the security update.
Users of Chromium-based browsers should monitor updates from their respective vendors because these browsers share components with Chrome and may require separate security patches.
What This Means for Browser Security
The latest Chrome zero-day highlights the continuing security challenges facing widely used web browsers.
Browsers regularly process untrusted content, making vulnerabilities in memory management and rendering components attractive targets for attackers.
For businesses, keeping browsers updated is an important part of endpoint security. Delayed patching can leave employees and organisational systems exposed to known vulnerabilities.
As attackers continue to exploit browser weaknesses, organisations need effective vulnerability management, regular software updates and security monitoring to reduce potential risks.
