Google patches Chrome XML vulnerability already exploited by hackers

Google has released security updates for Chrome after confirming that attackers are exploiting a high-severity vulnerability in the browser's XML component. Windows, Mac, Linux and Android users should update as soon as possible.

Google has issued another round of emergency security fixes for Chrome, addressing a vulnerability that hackers are already exploiting in real-world attacks.

The flaw, tracked as CVE-2026-125350, affects Chrome's XML processing component and could let attackers execute malicious code through specially crafted web content.

Google confirmed the active exploitation in a security advisory published alongside fixes for eight other vulnerabilities on Nov. 9.

Key points

• Google has patched CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component
• The company confirms that an exploit exists in the wild but has not disclosed details of the attacks
• This is the eighth Chrome zero-day Google has addressed in 2026
• Security updates are available for Windows, macOS, Linux and Android, with newer builds released Nov. 11

A memory flaw attackers are already exploiting

CVE-2026-125350 is a use-after-free vulnerability—a type of memory corruption bug that occurs when software tries to access memory that has already been released.

Such weaknesses can cause crashes, corrupt data, or potentially allow attackers to execute malicious code, depending on how the flaw is exploited.

In this case, the vulnerability affects Chrome's XML processing functionality, which handles structured web content.

A specially crafted webpage could potentially trigger the vulnerable code and allow an attacker to execute malicious instructions within Chrome's sandbox.

Google credits an anonymous researcher with reporting the flaw on Nov. 6.

While the company acknowledges that an exploit exists in the wild, it has not revealed who is behind the attacks, who was targeted, or how widespread the exploitation may be.

As is customary with actively exploited vulnerabilities, Google is restricting access to certain technical details until enough users have installed the security update.

The update addresses nine security vulnerabilities in total, including seven rated high severity and two rated medium severity.

The other flaws affect components including XML, V8, GPU, WebGL, FileSystem and Compositing.

Eight Chrome zero-days patched this year

The latest discovery brings the number of Chrome zero-days patched by Google in 2026 to eight.

Previous fixes addressed vulnerabilities in components including the V8 JavaScript engine, the Skia graphics library, and Dawn, the implementation of WebGPU used by Chromium.

In September, Google patched another actively exploited Chrome zero-day, tracked as CVE-2026-87491, involving an out-of-bounds write in the browser's V8 engine.

Update Chrome on desktop and mobile

Google initially released Chrome 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux, on Nov. 9.

On Nov. 11, the company issued newer desktop builds and an updated Android release.

The latest Stable channel versions are:

Google has also updated the Extended Stable channel for Windows and macOS to version 156.0.8078.100.

Importantly, Google says Android releases contain the same security fixes as their corresponding desktop releases unless otherwise noted.

This means Android users also receive protection against the XML vulnerability through the updated Chrome release.

The updates are rolling out gradually, so they may not immediately appear on every device.

To check for updates on Windows, Mac or Linux:

1.     Open Google Chrome

2.     Click the three-dot menu in the upper-right corner

3.     Select Help → About Google Chrome

4.     Allow Chrome to check for and install available updates

5.     Click Relaunch to complete the installation

Android users should open the Google Play Store and install the latest version of Chrome.

An updated version of Chrome (158.0.8127.35) is also available for iOS and iPadOS, delivering the usual “stability and performance improvements,” as per Google’s advisory.

Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera and Vivaldi, should also check for security updates from their vendors.

Keeping browsers updated is particularly important when vulnerabilities are being actively exploited. Browser flaws can expose users to attacks through web content, sometimes without requiring them to download suspicious files or install additional software.

Consider running a dedicated security solution across your personal devices to help block malicious websites, malware and other threats.

Related:

Big Tech calls for cyber-defense before AI attacks surge

Binance warns iPhone users of security flaw that could expose crypto wallets

Apple patches older iPhones against ‘extremely sophisticated’ attacks leveraging CoreGraphics flaw