security

Another Chrome memory bug gets squashed, but not before attackers got their hands on it

Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still left on the calendar.

The latest flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome's XML component. Google confirmed in a security advisory published Monday that attackers are already exploiting the bug, although it hasn't said who's behind the attacks or who might be getting targeted.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said, offering little else about the attacks.

The vulnerability was reported anonymously on November 6 and involves a memory management error that occurs when software continues using a pointer to memory that has already been freed.…