Chrome’s eighth exploited zero-day reaches users through webpages
Google’s Chrome 157 update fixes nine flaws, including an XML use-after-free that Google says is under active exploitation; SecurityWeek counts it as the browser’s eighth exploited zero-day of 2026. The issue is CVE-2026-125350. Google has not named an attacker or described the attacks, and is restricting technical details while users update.
CSIRT Italia says a user need only visit a prepared webpage: its XML content can make Chrome access memory it has already freed. An attacker can then corrupt memory in the affected process and, in some circumstances, execute code. Reporting does not establish whether exploitation escaped Chrome’s sandbox or what attackers did afterward.
If Chrome is routine software across your managed endpoints, ordinary browsing puts users in the potential attack path. The update closes the known flaw, but Google’s limited account leaves whether any particular organization was targeted—and what followed a successful exploit—unanswered.
CVSS 8.8 HIGH: use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.