Chrome zero-day whack-a-mole continues as 2026 tally hits 8
Google patches eighth actively exploited Chrome zero-day of 2026, CVE-2026-125350.
Google has released an update for Chrome to address its eighth actively exploited zero-day vulnerability of 2026, CVE-2026-125350. This high-severity use-after-free bug in Chrome's XML component was being exploited in the wild before a patch was available. The update, Chrome 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux, also fixes eight other security vulnerabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGoogle patched CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component that was actively exploited in the wild before a fix was available, marking the eighth Chrome zero-day of 2026. Zero-day exploitation means attackers had a window of opportunity with no vendor patch to close the gap, making rapid deployment of updates the only real defense once a fix is released. The sheer frequency of Chrome zero-days in 2026 demonstrates that browser attack surfaces are under sustained, targeted pressure. Organizations that delay browser updates even by hours or days materially increase their exposure to drive-by exploitation, credential theft, and sandbox escapes.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-125350
- cve — CVE-2026-125346