According to Google's security advisory on Monday, the company is aware of in-the-wild exploitation of CVE-2026-125350, a high-severity use-after-free flaw in the browser's XML processing component. Such a flaw occurs when software keeps using memory that has already been freed, and an attacker can exploit it to run code. The bug was reported to Google on November 6 by a researcher who asked to remain anonymous.
Google has not shared details about the attacks themselves, and said access to bug details will stay restricted until most users have updated. According to SecurityWeek, the update fixes nine vulnerabilities in total, including six other high-severity flaws in components such as WebGL, V8 and the GPU. At the time of publication, CISA had not yet added the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
What to do: update Chrome to version 157.0.8103.50 or later and restart the browser. Google says the update will reach all users over days or weeks, but according to BleepingComputer it is already available. Users who don't update manually can rely on Chrome, which installs the update automatically on the next launch.
