Vulnerabilities
Google patches eighth Chrome zero-day exploited in 2026
Google has fixed its eighth Chrome zero-day of 2026, a memory flaw attackers were already using. Users are urged to update their browsers as the patch rolls out.
Ross Grant2 min read
The short version
Google found and fixed a serious security bug in its Chrome browser that attackers were already using. The bug lets attackers run malicious code on a victim's computer. Users should update Chrome right away to stay safe. Google has not said who is being targeted or how the attacks work.
By the numbers
- 8Chrome zero-days exploited and fixed in 2026The Register
- 8Chrome zero-days exploited and fixed in 2025The Register
What happened?
Google has patched a high-severity vulnerability in Chrome, CVE-2026-125350, after confirming attackers were already exploiting it. The bug is a use-after-free flaw in Chrome's XML component. Google released a fix on 11 November 2026 and urges users to update their browsers. Only The Register has reported this so far, and details on the attacks remain limited.
How the flaw works
Google has fixed a high-severity vulnerability in Chrome, tracked as CVE-2026-125350. The flaw is a use-after-free bug in Chrome's XML component. A use-after-free occurs when software continues to use a pointer to memory that has already been freed. This can let attackers corrupt memory and potentially run malicious code. Google has not shared details on exactly how attackers are exploiting this bug, but confirmed that it is being used in real-world attacks [The Register (opens in a new tab)].
The response
Google published a security advisory on Monday, confirming the existence of attacks using this flaw. The company is holding back further technical details until enough users have updated, to prevent more attackers from copying the exploit. The patch is rolling out now and will reach users over the coming days and weeks. Users can check for updates manually by going to Chrome's Settings menu and selecting About Chrome. Google recommends updating as soon as possible, since attackers are already exploiting the vulnerability.
Is there a fix?
A patch for CVE-2026-125350 is available. Google says the update is rolling out automatically, but users can trigger it manually. This is the eighth Chrome zero-day fixed in 2026, matching the number from the previous year, with nearly two months left in the year.
What you should do
Anyone using Chrome should update their browser immediately. To do this, open Chrome, go to Settings, and select About Chrome. This will check for updates and install the latest version if one is available. Keeping browsers up to date is one of the best ways to protect against attacks that exploit newly discovered vulnerabilities.
Timeline
- 6 November 2026: Vulnerability reported anonymously.
- 11 November 2026: Google confirms active exploitation and releases a patch.
So far, only The Register has reported on this story. Google has not said who is behind the attacks or who is being targeted. Technical details on how the exploit works are not yet public.
Why it matters
Chrome is one of the most widely used browsers. Attackers exploiting a zero-day means users are at risk until they update. Quick patching is essential to stay protected.
Key points
- Google fixed its eighth Chrome zero-day of 2026, CVE-2026-125350.
- Attackers were already exploiting the bug before the patch.
- The flaw is a use-after-free in Chrome's XML component.
- Users should update Chrome immediately to stay protected.
- Technical details and attacker identity are not yet public.
Sources
The Register
Reference
