Google shipped a Chrome update on November 9 with one line nobody likes reading: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."
According to The Hacker News, that makes it the eighth actively exploited Chrome zero-day of 2026. It's November. We're averaging almost one a month.
What We Know
From Google's release notes:
- The bug: CVE-2026-125350, a high-severity use-after-free in Chrome's XML handling.
- Reported by: an anonymous researcher on November 6. Google turned around a fix in three days.
- Fixed in: Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. The Extended Stable channel got the fix too.
- Exploitation: confirmed in the wild by Google, with no details on who's using it or against whom. That's normal. Google keeps bug details restricted until most users are patched.
What we don't know: the attacker, the targets, or the rest of the chain. A browser bug like this is usually one link, often paired with a sandbox escape. I'm not going to speculate past what Google published.
Credit Where It's Due
Three days from report to fix, pushed to a few billion browsers. Say what you want about Chrome bug counts, but that pipeline is a serious piece of engineering.
Why It Keeps Happening
The browser is where work happens now. SaaS, AI tools, admin consoles, email: all of it is a tab. That makes the browser the most attacked application on the planet, and the rendering engine parses hostile content all day. Use-after-free bugs in memory-unsafe code are the result.
You can't patch your way to zero risk here, but you can shrink the window and the blast radius:
What To Do
- Update now. Check
chrome://settings/helpand restart the browser. The update doesn't protect you until you relaunch, and some people haven't closed Chrome since summer. - Enforce it centrally. Use browser management to force relaunch within a day or two. Don't leave it to users.
- Don't forget the Chromium family. Edge, Brave, Opera and Vivaldi will ship their own updates. Track them.
- Limit what a popped browser can reach. Least-privilege access to apps, isolation for risky or uncategorized sites, and no standing admin rights on endpoints all reduce what one exploited tab buys an attacker.
Bottom Line
Eight in-the-wild Chrome zero-days this year. The fix is out. Restart your browser, then go make sure everyone else did too.
Sources: Google Chrome Releases, The Hacker News