Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely
Google has released a security update for Chrome to address a high-severity zero-day vulnerability, CVE-2026-125350, which is currently being exploited in the wild. The flaw allows remote attackers to execute malicious code through the browser's XML component.
Why it matters
As browsers are primary gateways to the internet, unpatched vulnerabilities pose a significant risk to user data and system security globally.
Google has fixed a Chrome zero-day that attackers are already using. The flaw is tracked as CVE-2026-125350, and it lets a remote attacker run malicious code in the browser.
Google’s Stable channel update moves Chrome to version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The rollout will reach users over the coming days and weeks. The Chrome Security team explains that bug details stay locked until most users have the fix.
CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component. Google says it is aware that an exploit for this flaw exists in the wild. An anonymous researcher reported it on November 6, 2026, only three days before the patch shipped.
Also covering this story
One other newsroom covered this event. We read that version too.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in