Google Patches Critical Chrome Zero-Day Exploiting XML Vulnerability

Google has released a Chrome security update addressing an actively exploited vulnerability in the browser’s XML component, bringing the number of Chrome zero-days patched this year to eight. The disclosure places renewed pressure on organisations to accelerate browser updates and verify that users have relaunched affected installations.

The vulnerability, tracked as CVE-2026-125350 , is a high-severity use-after-free flaw. Google released the fix on November 9 after receiving an anonymous report three days earlier.

“Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the company stated in its Chrome security advisory . The update contains nine security fixes.

The latest disclosure follows seven other actively exploited Chrome vulnerabilities patched during 2026. However, the existence of real-world exploitation does not establish how widespread the attacks are or which users face the greatest exposure.