Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
AI-summarised brief · reviewed before publication
Google released a Chrome update on Monday that patches nine vulnerabilities, including CVE‑2026‑125350, a high‑severity use‑after‑free bug in the XML component that allows remote code execution via a crafted HTML page. The flaw, discovered on November 6, 2026, is actively exploited in the wild. Google has addressed eight actively exploited zero‑days this year, and the U.S. Cybersecurity and Infrastructure Security Agency has added the issue to its Known Exploited Vulnerabilities catalog, mandating federal patching by November 24. Users must update to Chrome 157.0.8103.50 or newer across all platforms.
💡 Why It Matters
- · The active exploitation of a critical Chrome flaw underscores the urgency of timely patching for web browsers, a primary vector for cyberattacks.
- · Federal agencies face a hard deadline, amplifying pressure on organizations to secure their systems before the vulnerability can be leveraged at scale.