# Google Addresses Eighth Actively Exploited Chrome Zero-Day Vulnerability of 2026 A high-severity memory flaw in Chrome's XML component requires immediate user updates. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/90e17588-d4d8-4540-aee7-503a636188eb ## Eighth Zero-Day Incident Google has patched its eighth actively exploited zero-day vulnerability of 2026, matching the total count for the entire previous year. The flaw, tracked as CVE-2026-125350, is a high-severity use-after-free bug located within the browser's XML component. This vulnerability was reported anonymously on November 6, prompting an immediate security advisory release. ## Memory Management Risks The vulnerability involves a memory management error where software continues using a pointer to memory that has already been freed. This technical flaw can potentially allow attackers to corrupt memory or execute arbitrary malicious code. Google confirmed awareness of existing exploits in the wild, though specific attack details remain undisclosed. ## Update Deployment Details The patch is included in Chrome versions 157.0.8103.50 and .51 for Windows and macOS, while Linux users receive version 157.0.8103.50. Users can manually trigger the update process by navigating to the About Chrome menu. Google warns that the update will roll out over the coming days, making manual checks highly recommended. ## Broader Security Patching Beyond the zero-day fix, this update addresses eight additional security vulnerabilities. These include high-severity flaws affecting WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine. Another use-after-free bug in the XML component, CVE-2026-125346, was also resolved, though it has not been linked to any active exploitation in the wild. ## Information Disclosure Strategy Google is withholding detailed technical information regarding the exploit to prevent further abuse. The company stated that access to bug details may remain restricted until a majority of users have successfully installed the fix. This approach is also applied if the vulnerability exists in third-party libraries shared by other projects. ## Chromium Ecosystem Impact The security risks extend beyond the official Google Chrome browser. Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are advised to apply these fixes as they become available. These browsers rely on the same core engine, making them susceptible to the same underlying memory management vulnerabilities. ## 2026 Vulnerability Trends The frequency of zero-day exploits has remained high throughout 2026. By June, five actively exploited flaws had already been patched, involving the V8 engine, Skia library, and WebGPU. With two additional V8 bugs fixed in September and this latest XML issue, the total has reached eight, mirroring the 2025 annual record. ## Security Maintenance Outlook With nearly two months remaining in 2026, it is uncertain if further zero-day vulnerabilities will emerge. The consistent discovery of these flaws highlights the ongoing challenges in securing complex browser architectures. Users should prioritize regular updates to mitigate risks associated with memory corruption and potential arbitrary code execution by attackers. ## Sources covering this story - [The Hacker News — Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026](https://thehackernews.com/2026/11/google-issues-chrome-security-update.html) - [www.theregister.com - Articles — Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026](https://www.theregister.com/security/2026/11/10/chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8/5308732) - [www.theregister.com - Articles (theregister.co.uk) — Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026](https://www.theregister.com/security/2026/11/10/chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8/5308732) - [Lifehacker — Actively Exploited Chrome Vulnerability Demands Immediate Browser Updates](https://lifehacker.com/tech/this-actively-exploited-security-vulnerability-is-putting-your-chrome-browser?utm_medium=RSS) - [cybersecurity — Google Patches Critical Chrome Zero-Day Vulnerability](https://www.reddit.com/r/cybersecurity/comments/1xsvy9p/google_patches_chrome_zeroday_already_exploited/) - [Security Affairs — Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026](https://securityaffairs.com/202772/breaking-news/google-fixes-the-eighth-actively-exploited-chrome-zero-day-of-2026.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._