Google Patches Chrome Zero-Day Already Exploited in Attacks

Google has released a Chrome security update after confirming that attackers are exploiting a newly patched flaw in the wild. The vulnerability, CVE-2026-125350, is a use-after-free issue in Chrome’s XML component. Google has not said who is behind the attacks, how many people were targeted or precisely how the exploit works. That makes the practical advice more important than speculation: desktop users should check that the update has installed and restart the browser.

According to Google’s 9 November release notice, the fixed Stable versions are 157.0.8103.50 or .51 on Windows and macOS, and 157.0.8103.50 on Linux. The update contains nine security fixes. Google explicitly identifies CVE-2026-125350 as a flaw with an exploit in the wild, while withholding further technical detail until more users have updated.

A zero-day is a vulnerability that defenders had no public patch for when attackers began using it. Chrome processes content from websites and web applications throughout a normal working day, so a weakness in that path can create a broad exposure. A use-after-free is a memory-handling error, although the exact consequences in this case cannot be inferred from the label alone. Google’s notice does not establish that the flaw can, by itself, give an attacker complete control of a computer.

The company lists another XML use-after-free issue, CVE-2026-125346, in the same release. It has not marked that second issue as exploited. Keeping the two distinct matters. The headline is about the flaw for which Google says an in-the-wild exploit exists, not every bug addressed in the update.

Security teams should check their deployed Chrome versions, particularly on machines used for email, banking and administrative access. Organisations with managed browsers should confirm that endpoints have actually received the patched version and that users have restarted Chrome. A policy configured to allow updates is not proof that every open browser process has loaded the new build.

Chrome users can open the browser’s About Google Chrome page from its Help menu to check the current version and trigger a pending update. When Chrome asks for a relaunch, save work and restart it. Other Chromium-based browsers may issue their own fixes on different schedules, so users of those products should follow their vendor’s release information rather than assuming a Chrome update has already covered them.

Google says the new Stable build will roll out over the coming days or weeks. That staggered rollout is normal, but the existence of an active exploit makes verification worthwhile. The company has not published indicators that would allow ordinary users to determine whether their own browsing session was targeted.

TechBooky reported an earlier exploited Chrome flaw this year. The latest notice is a fresh patch, with its own CVE and affected versions. The broader lesson is unchanged: browser updates are not background housekeeping when a vendor says a vulnerability is already being used in real attacks.