Google patches eighth Chrome zero-day of 2026, an XML flaw already exploited in the wild
Users who have not updated Chrome 157 remain exposed to an attack Google has not yet described in detail.
Google has shipped Chrome 157 updates that fix nine vulnerabilities, one of them a high-severity use-after-free flaw in the XML component that is already being exploited in the wild. The bug, tracked as CVE-2026-125350, was reported by an anonymous researcher on November 6, and Google has withheld further details about the attacks and their operators. CISA had not yet listed the flaw in its Known Exploited Vulnerabilities catalog at the time of reporting. This is the eighth Chrome zero-day exploited so far in 2026. Besides the zero-day, the release patches six high-severity bugs across several components and two medium-severity uninitialized-resource issues in the GPU component. Users on Windows and macOS should move to 157.0.8103.50/.51 and Linux users to 157.0.8103.50, and Chromium-based browsers such as Edge, Brave, Opera and Vivaldi should apply their own fixes as they arrive.
Why it matters
Chrome is the browser most people rely on, so an exploited flaw reaching it is felt widely. This is the eighth Chrome zero-day exploited this year, which means attackers have repeatedly found working bugs in the browser in 2026. Because Google has withheld details of how the XML flaw is abused and CISA had not yet listed it, users cannot yet judge how far the attacks reach. The practical effect is that anyone running an older Chrome build is carrying a known, actively used weakness until they install the update.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.