Chrome zero-day whack-a-mole continues as 2026 tally hits 8
MentionsGoogleGoogle Chrome
Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still left on the calendar. The latest flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome's XML component.
Summary from The Register Security.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
