GoogleAnalysisGoogle patches active zero-day XML use-after-free flaw in Chrome
What happened.Google released an emergency security update for the Chrome desktop browser resolving an actively exploited zero-day vulnerability in its XML parser.
Why it matters.Web browsers process untrusted remote markup on employee workstations. When an XML parser triggers memory corruption through a freed pointer, malicious websites execute arbitrary code within the browser sandbox. Engineering teams must restart Chrome desktop instances immediately to complete update installation. Administrators should enforce automatic browser restart policies across managed fleets.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-125350, the defect is a high-severity use-after-free flaw in Chrome core XML component.
- Exploit status: Google confirmed an active exploit exists in the wild, marking the eighth zero-day patched in Chrome during 2026.
- Affected versions: The flaw impacts Chrome desktop installations across Windows, macOS, and Linux prior to version 157.0.8103.50.
- Remediation releases: Patches rolled out in desktop builds 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux.
- Auxiliary fixes: The release delivers eight additional patches, resolving WebGL memory initialization and GPU boundary write defects.