Google Issues Chrome Security Update for Actively Exploited Zero-Day Vulnerability

Google released an emergency security update on November 9, 2026, addressing an actively exploited zero-day vulnerability in its Chrome web browser tracked as CVE-2026-125350.

The high-severity memory-safety defect resides in the browser’s XML component and was reported anonymously just days prior on November 6, 2026. Security advisory details confirm that Google is aware that an exploit for CVE-2026-125350 exists in the wild, according to the company’s Monday security advisory.

Technical Breakdown of the XML Use-After-Free Defect

CVE-2026-125350 involves a use-after-free weakness within the browser’s XML parser. Malicious actors can take advantage of memory that has been cleared and subsequently accessed to execute code, corrupt information, or precipitate system crashes. Google confirmed that an exploit exists in the wild, making deployment urgent for organizations and individual users.

The company has kept confidential the specific XML execution route, the circumstances required to trigger the bug, the identity of the threat actors, the breadth of the campaign, and whether other security flaws aided the attack.

Because web browsers process untrusted content continuously, memory parsing flaws in components like XML frequently attract exploitation attempts via booby-trapped pages. Google said it would distribute the update over the coming days or weeks. Enterprise users receive the patch through the Extended Stable channel in version 156.0.8078.96.

Broader Scope of the Emergency Patch

The November 9 emergency release patches nine security flaws in total, seven of which carry high severity ratings. Alongside the exploited XML zero-day, the advisory details separate component repairs across graphics, storage, and script engines. These include type confusion in V8, out-of-bounds writes in the GPU component, buffer overflows in compositing, incorrect authorization in the FileSystem, and uninitialized resources in WebGL.

On October 12, Arni Hardarson from Neonix Security disclosed another XML use-after-free vulnerability designated as CVE-2026-125346, though the advisory does not link it to the currently exploited flaw. Two medium-severity bugs described as uninitialized resource issues in the GPU component, CVE-2026-125349 and CVE-2026-125342, have also been fixed, with Vo Duc Thang reporting the second one. Google discovered most of the flaws internally.

Google stated that access to bug details and links remain restricted to limit information available for independent exploit analysis until most users apply the fixes.

Tracking Active Exploits Across 2026

The newly patched flaw represents the eighth actively exploited Chrome zero-day that Google has addressed since the start of 2026. The list of previously addressed vulnerabilities features CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

Security agencies and independent researchers track these browser updates closely as threat actors use memory corruption bugs. Whenever software manufacturers issue updates, individuals operating alternative Chromium-powered browsers such as Vivaldi, Opera, Brave, and Microsoft Edge ought to install the patches promptly. To ensure the latest updates are installed, users can open Chrome, go to More, Help, About Google Chrome, and select Relaunch to complete installation.

Access to bug details and links may be kept restricted until a majority of users are updated with a fix.

has reported that specific technical information regarding the vulnerabilities will remain limited for the time being.

More on Google: Google Acquires Crusoe's Unfinished Wyoming Data Center Site · Google Invests $17 Billion in Wyoming Data Center With Carbon Capture