Google has patched a high-severity zero-day in Chrome that it says is already being exploited in the wild. The flaw, tracked as CVE-2026-125350, is a use-after-free vulnerability in the browser’s XML component.
Google included the fix in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, with the desktop rollout continuing over the coming days and weeks. The same security fixes are included in Chrome 157.0.8103.50 for Android, which Google says is being distributed through Google Play over the next few days. The details appear in Google’s November Chrome release notes.
Google said an anonymous researcher reported the bug on November 6 and confirmed that an exploit for it exists in the wild. The company has not disclosed details about the attacks or identified the people behind them. SecurityWeek reported that Google had not shared technical information about the exploitation when it published its November 10 account.
The release fixes nine security issues in total, seven rated high and two medium, according to Google’s release notes. The high-severity fixes cover WebGL, FileSystem, Compositing, GPU, V8 and XML components, while the medium-severity issues involve uninitialized resources in the GPU component.
The latest patch builds on Chrome 157’s earlier stable release, which included 213 security fixes, and follows Google’s September fix for another actively exploited Chrome zero-day, CVE-2026-85046.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
