Summary
- Google released a Chrome update addressing nine vulnerabilities, including one under active exploitation.
- The exploited flaw, CVE-2026-125350, is a use-after-free bug in Chrome's XML component and carries a high severity rating.
- No CVSS score has been assigned at time of reporting, and corroborating sources are not yet available.
- This is the eighth actively exploited Chrome zero-day patched by Google in 2026 alone.
- Security teams should prioritise updating Chrome across managed endpoints without waiting for routine patch cycles.
What Google Has Released
Google on Monday pushed a Chrome security update addressing nine vulnerabilities in total. One of those vulnerabilities is confirmed to be under active exploitation in the wild. The update applies to the stable channel, and organisations relying on Chrome across their enterprise estate should treat this as a priority deployment.
The Vulnerability in Detail
The actively exploited flaw has been assigned the identifier CVE-2026-125350. It is classified as a use-after-free bug residing in Chrome's XML component. Use-after-free vulnerabilities arise when a program continues to reference a block of memory after that memory has been freed. This class of flaw can allow an attacker to execute arbitrary code, corrupt memory, or cause unpredictable application behaviour, depending on how the freed memory is subsequently accessed or reallocated.
Severity and Scoring
Google has rated the vulnerability as high severity. At the time of reporting, no CVSS score has been formally assigned, which means automated vulnerability management tools that rely on CVSS thresholds to triage patching may not yet surface this issue with appropriate urgency. Security teams should not wait for a score before acting. The confirmed in-the-wild exploitation is itself a sufficient signal.
A Pattern Worth Noting
This is the eighth Chrome zero-day that Google has been required to patch under active exploitation in 2026. That cadence is notable. It suggests sustained adversary interest in Chrome as an attack surface, which is unsurprising given the browser's near-ubiquitous presence across enterprise and personal computing environments. Whether these incidents reflect a single threat actor, multiple independent campaigns, or a broader trend in browser-targeted exploitation is not clear from the available source material.
What Is Not Yet Known
Google has not disclosed technical details about the nature of the exploitation, the threat actors involved, or the targets affected. This is consistent with standard practice during active exploitation windows, where limiting attacker knowledge of patch details can slow further weaponisation. No corroborating sources were available at time of publication, so the broader context of this campaign remains limited.
Why it matters
Chrome sits at the front door of most enterprise environments. A high-severity, actively exploited use-after-free flaw in the browser's XML handling presents a credible code execution risk for any user on an unpatched version. With eight zero-days already patched in 2026, the volume of active exploitation against Chrome should prompt CISOs to revisit browser patch cadence policies. If your organisation applies Chrome updates on a weekly or fortnightly cycle, this event is a reasonable prompt to evaluate whether that cycle is fast enough given current threat activity. Enterprises using Chrome Enterprise should verify that automatic update mechanisms are functioning as intended and that browser versions are being reported and tracked through endpoint visibility tooling.
What to do now
- Deploy the latest Chrome stable channel update across all managed endpoints as a priority, outside normal patch cycle schedules if necessary.
- Verify that Chrome's automatic update mechanism is enabled and functioning across your enterprise estate.
- Check endpoint management and vulnerability management platforms for visibility into which devices are running outdated Chrome versions.
- Do not wait for a CVSS score to be assigned before prioritising this update, given the confirmed active exploitation status.
- Monitor Google's official Chrome Releases blog and your threat intelligence feeds for any further disclosure about affected targets or threat actor attribution.
