Google Patches Chrome Zero-Day CVE-2026-125350, Eighth Exploited This Year
Summary
Google says attackers are exploiting a high-severity use-after-free flaw in Chrome's XML component. Patches are rolling out for Stable Desktop on Windows, macOS, and Linux; Google has not disclosed incident details.
Key points
- Google said an exploit for CVE-2026-125350 exists in the wild.
- The high-severity flaw is a use-after-free vulnerability in Chrome's XML component.
- Google released fixes for Stable Desktop on Windows, macOS, and Linux.
- The article lists macOS versions 157.0.8103.50/.51 and Linux version 157.0.8103.50.
- Google said the update may take days or weeks to reach all users; users can check for updates manually or let Chrome update after relaunch.
- Google has not shared further details about the exploitation incidents.
Article Details
- Vulnerability Types
- Use-after-free (UAF) in Chrome's XML component
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Update Chrome to the patched Stable Desktop release; Chrome can check for updates and install them after the next launch.
MITRE ATT&CK
CVE
CVE-2026-11645Google · ChromeAn out-of-bounds read and write vulnerability in Chrome's V8 JavaScript engine (CVE-2026-11645), exploited in the wild and patched in June.CVE-2026-125350Vendor / Product unavailable"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.CVE-2026-2441Google · ChromeAn iterator invalidation bug (CVE-2026-2441) in CSSFontFeatureValuesMap (Chrome's implementation of CSS font feature values), which Google addressed in mid-February.CVE-2026-3909Google · Chromein attacks were patched in March: an out-of-bounds write weakness in the Skia 2D graphics library (CVE-2026-3909), and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engineCVE-2026-3910Google · Chromeand an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).CVE-2026-5281Google · ChromeA use-after-free weakness in Dawn (CVE-2026-5281), the underlying cross-platform implementation of the WebGPU standard used by the Chromium project, which Google patched in April.CVE-2026-85046Google · ChromeAnd out-of-bounds write (CVE-2026-87491) and type confusion (CVE-2026-85046) flaws in the V8 JavaScript engine, fixed in September.CVE-2026-87491Google · ChromeAnd out-of-bounds write (CVE-2026-87491) and type confusion (CVE-2026-85046) flaws in the V8 JavaScript engine, fixed in September.