Google has fixed a Chrome zero-day that attackers are already using. The flaw is tracked as CVE-2026-125350, and it lets a remote attacker run malicious code in the browser.
Google’s Stable channel update moves Chrome to version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The rollout will reach users over the coming days and weeks. The Chrome Security team explains that bug details stay locked until most users have the fix.
CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component. Google says it is aware that an exploit for this flaw exists in the wild. An anonymous researcher reported it on November 6, 2026, only three days before the patch shipped.
Google has not said who is using the exploit or how many people were targeted. A use-after-free flaw happens when a program keeps using memory after it has been released. Attackers can sometimes use this to crash the browser or run their own code, often through a booby-trapped web page.
Eight More Flaws Fixed in the Same Update
The release carries nine security fixes in total, and seven of them are rated High. Google’s list includes an uninitialized resource in WebGL (CVE-2026-125345), incorrect authorization in FileSystem (CVE-2026-125347), a buffer overflow in Compositing (CVE-2026-125343), an out-of-bounds write in GPU (CVE-2026-125348), and type confusion in V8 (CVE-2026-125344).
A second use-after-free in XML, CVE-2026-125346, came from Arni Hardarson of Neonix Security. Two Medium flaws were also fixed. These are CVE-2026-125349 and CVE-2026-125342, and both are uninitialized resource bugs in the GPU. Vo Duc Thang reported the second one. Google’s own team found most of the rest. The full issue tracker list will open up once most users are updated.
| CVE ID | Component | Flaw Type | Report Date |
|---|---|---|---|
| CVE-2026-125350 | XML | Use after free (exploited in the wild) | 2026-11-06 |
| CVE-2026-125346 | XML | Use after free | 2026-10-12 |
| CVE-2026-125344 | V8 | Type confusion | 2026-10-02 |
| CVE-2026-125348 | GPU | Out-of-bounds write | 2026-09-18 |
| CVE-2026-125347 | FileSystem | Incorrect authorization | 2026-09-15 |
| CVE-2026-125343 | Compositing | Buffer overflow | 2026-09-15 |
| CVE-2026-125345 | WebGL | Uninitialized resource | 2026-08-21 |
| CVE-2026-125342 | GPU | Uninitialized resource | 2026-09-26 |
| CVE-2026-125349 | GPU | Uninitialized resource | 2026-07-20 |
Browsers read untrusted content all day, so memory bugs in parts like XML are a favorite target. A victim may only need to open a bad link. Attackers can send that link through phishing emails, ads, or hacked sites.
We saw the same pattern when Google patched an earlier Chrome zero-day in June, which also allowed remote code execution through a crafted page. The newest fix also reaches enterprise users. The Extended Stable channel gets the same zero-day patch in version 156.0.8078.96.
This patch arrives just days after Chrome 157 launched. That release fixed 213 security issues, including seven rated Critical, as our earlier report on the Chrome 157 update covered.
Google says many of its security bugs are caught by tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity and libFuzzer. These tools help find memory errors before they reach the stable channel. Zero-days like this one show that some still slip through. You can read the full list of code changes in this build.
Chrome downloads updates in the background, but the fix only works after a restart. Open the menu, choose Help, then About Google Chrome, and select Relaunch when it appears. Linux users should update through their package manager.
People who use Chromium-based browsers should watch for vendor patches, because they often share the same engine code.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
The post Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely appeared first on Cyber Security News.