Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Summary: Google released Chrome updates on Monday patching nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free bug in the XML component (CVSS 8.8) that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Google says an exploit for the flaw exists in the wild, making it the eighth actively exploited Chrome zero-day of 2026, and CISA has added it to its KEV catalog with a federal patch deadline of November 24, 2026.
What's compelling: This is the eighth Chrome zero-day exploited in the wild this year, and Google has not disclosed who is behind the attacks or how the flaw is being abused - federal agencies have until November 24, 2026 to patch, and everyone else is working without those details.