Get the free digest
AI & Tech

Chrome zero-day whack-a-mole continues as 2026 tally hits 8

Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still left on the calendar.

✦ Extractive summary — built from the sources' own reporting•From 1 source•1 min read•Updated November 10, 2026, 1:28 PM UTC
Key points
  • The release fixes another use-after-free bug in Chrome's XML component, CVE-2026-125346, which was reported by Arni Hardarson of Neonix Security in October, though Google hasn't indicated that this second vulnerability is being exploited.
  • The vulnerability was reported anonymously on November 6 and involves a memory management error that occurs when software continues using a pointer to memory that has already been freed.
  • The latest discovery adds to what's becoming a rather long list of Chrome zero-days this year.

That puts 2026 level with 2025, when Google also fixed eight Chrome zero-days exploited in the wild.

By June, Google had already patched five actively exploited Chrome zero-days, including flaws in its V8 JavaScript engine, Skia graphics library, and WebGPU implementation.

Additional details
  • Google says the latest update will roll out over the coming days and weeks, but users can check manually by heading to Chrome's Settings menu and selecting About Chrome.
  • With attackers already making use of the vulnerability, it's probably worth doing that sooner rather than waiting for Chrome to get around to it.
  • "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said, offering little else about the attacks.
  • The latest flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome's XML component.
  • Google is keeping further technical details under wraps until enough users have installed the fix, a familiar approach intended to stop other attackers from getting their hands on a working exploit.

How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →

Advertisement

Every article behind this summary — 1 article from 1 outlet

The RegisterNovember 10, 2026, 1:28 PM UTC →

Related stories