Google Patches Chrome Zero-Day After Confirming Active Exploitation

Google has released a Chrome security update for a vulnerability already exploited in attacks, closing a browser risk for crypto users accessing online services.

The flaw, CVE-2026-125350, is in Chrome’s XML component and is a use-after-free memory error. The update also fixes eight other vulnerabilities, for nine fixes in total. An anonymous researcher reported the issue on Nov. 6.

Google confirmed it had found exploitation of the flaw but did not disclose how the attacks worked, who was targeted or who carried them out. Chrome versions 157.0.8103.50 and 157.0.8103.51 are available for Windows and macOS; Linux is receiving version 157.0.8103.50.

The update is rolling out over the next several days to several weeks. Google recommends updating and restarting Chrome to apply the fix. For crypto users, the vulnerability affects the browser layer used to access online services.