Google patches eighth Chrome zero-day exploited in attacks this year

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.

As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.

Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code.

While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents.