Google has shipped emergency Chrome updates for CVE-2026-125350, a high-severity use-after-free in Chrome’s XML code that is already being exploited, BleepingComputer reports. That’s the eighth exploited Chrome zero-day this year. Google hasn’t shared details of the attacks.
The fix is in the Stable desktop channel: 157.0.8103.50/.51 on Windows and macOS, and 157.0.8103.50 on Linux. It can take days or weeks to roll out everywhere, but the update was available immediately when BleepingComputer checked. Help > About Google Chrome will pull it, then relaunch.
My take
Eight in one year is a lot. Update today, and if you manage a fleet, don’t wait for the slow ring.
God Bless, and Happy hacking!
