Technology news and discussion on TalkFuse.
Google patches eighth actively exploited Chrome flaw of 2026
Google has patched its eighth actively exploited Chrome zero-day of 2026, matching the total for all of 2025 with nearly two months of the year remaining. The flaw, CVE-2026-125350, is a high-severity memory bug in Chrome’s XML component; Google says attackers are exploiting it but has not disclosed who is responsible or who is being targeted.
The vulnerability was reported anonymously on 6 November and is a use-after-free error, which can potentially let attackers corrupt memory and run malicious code. Google has released fixes in Chrome versions 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux, alongside fixes for eight other security issues. It is withholding further technical details until more users install the update; users can check for it in Chrome’s About Chrome settings.
In short
- Chrome’s 2026 zero-day count has reached eight.
- Attackers are exploiting a newly patched XML memory flaw.
- Google is rolling out fixes across Windows, macOS and Linux.
Explained simply
Chrome is Google’s web browser, and its XML component helps it handle certain kinds of web content. A use-after-free flaw can arise when software tries to use memory after it has been released; attackers may be able to exploit such a bug to run harmful code.
A zero-day is a vulnerability that attackers are using before many users have had time to install a fix. Google develops Chrome and distributes updates, while security researchers and users help identify and report flaws. Details about the people behind these attacks and who they target are not always made public.
Browsers are used to access websites and online services, so flaws can affect many people and organisations. Keeping software updated helps reduce the risk of known vulnerabilities being used against devices.
Read the full article at the source →
Originally published by The Register as “Chrome zero-day whack-a-mole continues as 2026 tally hits 8”.