Skip to content
securitytabs

Updated · 1 update

Google patches eighth exploited Chrome zero-day of 2026, in XML component

Google has released a Chrome update that fixes a flaw in the browser that attackers are already using, and a US government agency has told federal agencies to fix it. Organizations that rely on Chrome should make sure browsers are updated now.

Exploited memory flaw in Google Chrome XML component fixed
Exploited memory flaw in Google Chrome XML component fixed

What's new

  1. CISA added the flaw to its Known Exploited Vulnerabilities catalogue; the report now reflects the listing and NVD's score. [1]

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Google released Chrome updates that fix nine security vulnerabilities, including one that it says is being exploited in the wild. The flaw, tracked as CVE-2026-125350, is a high-severity use-after-free (a memory error that occurs when a program uses memory after it has been released) in Chrome's XML component. NVD rates it 8.8 on the CVSS scale. [2][3]

SecurityWeek reports the flaw was reported anonymously on November 6. It is the eighth Chrome zero-day (a flaw exploited before a fix existed) Google has patched this year, which The Register notes matches the total for all of last year. [4][5]

Exploitation

Google says the flaw has come under active exploitation. The coverage reviewed gives no details about the attackers, targets or attack method. [2][6]

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on November 10. The federal due date for agencies to fix it is November 24. [1]

What is not yet known

Who is behind the attacks and how widely the flaw has been used has not been disclosed. Security Affairs describes the bug as a V8 issue while other outlets place it in the XML component; the sources otherwise agree on a use-after-free. [6][5]

Timeline

  1. CISA added the flaw to its KEV catalogue. [1]

  2. Google said one of the fixed flaws was being exploited, the eighth Chrome zero-day this year. [3]

  3. Google released Chrome updates fixing nine vulnerabilities. [2]

  4. The flaw was reported to Google anonymously. [4]

Update history

  1. CISA added the flaw to its Known Exploited Vulnerabilities catalogue; the report now reflects the listing and NVD's score. [1]

  2. First published

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Chrome is used on most office computers, and Google says this flaw is already being exploited. A fixed version has been released. [2]

What to do

  1. Update Chrome on every computer to the latest version Google released. [2][3]
  2. Ask your IT provider to confirm that managed devices have received the latest Chrome update. [3]

Mid-size company

A small IT or security team

What to know

Google has patched an actively exploited Chrome flaw that CISA has listed; no indicators of compromise have been published in the coverage reviewed. [2][1]

What to do

  1. Push the latest Chrome update through your patch management and verify installed versions across the fleet. [2][3]
  2. Watch Google's Chrome release notes for further details on exploitation. [2]

Large enterprise

A security operations team

What to know

This is the eighth exploited Chrome zero-day this year and CISA lists it as exploited; Google has not published details of the attacks. [5][1]

What to do

  1. Inventory Chrome installations and confirm the fixed release is deployed. [2][3]
  2. Treat the November 24 CISA due date as a reference deadline for patching. [1]
  3. Watch Google's advisories for further details on exploitation, since no indicators have been published. [2]

Sources

  1. [1]CISA Advisories · Nov 10, 12:00 UTC
    CISA Adds Six Known Exploited Vulnerabilities to Catalogcontext
  2. [2]The Hacker News · Nov 10, 06:52 UTC
    Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026context
  3. [3]BleepingComputer · Nov 10, 08:51 UTC
    Google patches eighth Chrome zero-day exploited in attacks this yearcontext
  4. [4]SecurityWeek · Nov 10, 06:12 UTC
    Chrome Update Patches Exploited XML Zero-Day, Eighth This Yearcontext
  5. [5]The Register Security · Nov 10, 13:28 UTC
    Chrome zero-day whack-a-mole continues as 2026 tally hits 8context
  6. [6]Security Affairs · Nov 10, 10:05 UTC
    Google fixes the eighth actively exploited Chrome zero-day of 2026context