Chrome zero-day count hits 8 as attackers exploit another critical memory bug

Google has rushed out an emergency patch for Chrome after discovering attackers are actively exploiting a new zero-day vulnerability, designated CVE-2026-125350. This high-severity flaw is a 'use-after-free' bug in the browser's XML component, a type of memory management error that can let attackers corrupt memory and run malicious code. It's the eighth such actively exploited Chrome zero-day Google has fixed this year, matching the total for all of 2025 with nearly two months still left in the calendar.

The patch is included in versions 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. The update also squashes eight other security holes, including high-severity issues in WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine. Google is withholding technical details to prevent other attackers from building exploits, but the rapid succession of these critical fixes highlights the intense pressure on Chrome's security team as they play a high-stakes game of whack-a-mole with persistent threat actors.