Google Issues a Warning to Chrome Users

Google has released an important security update for its Chrome browser after confirming that a vulnerability in the browser’s XML component is being actively exploited. The flaw, tracked as CVE-2026-125350, is classified as a high severity use after free vulnerability. Google received an anonymous report about the issue on November 6 and released a fix on November 9. The latest Stable channel update includes nine security fixes. With this disclosure, the number of Chrome zero-day vulnerabilities reported as actively exploited and patched during 2026 has reached eight. The development highlights the importance of installing browser security updates without delay.

According to Google’s security advisory, the company is aware that an exploit targeting CVE-2026-125350 exists in the wild. A use-after-free vulnerability occurs when software attempts to access a memory location after that memory has already been released for reuse. Depending on how the flaw is exploited, it can cause application crashes, data corruption, information disclosure or potentially allow attackers to execute malicious code. However, Google has not publicly disclosed the precise attack method, the identity of the attackers, the organisations targeted or the number of affected users. Therefore, the available information confirms active exploitation but does not establish how widespread the attacks are or whether the vulnerability has been used to compromise entire systems.

The latest Chrome update also addresses other security weaknesses affecting components such as WebGL, FileSystem, Compositing, GPU, V8 and XML. Google has released patched desktop versions through its Stable channel, with the update being rolled out gradually. The company has also acknowledged that browser sandboxing helps restrict the activities of compromised processes by limiting their access to operating-system resources. However, there is no public confirmation that CVE-2026-125350 includes a sandbox escape. Google’s disclosure follows seven other actively exploited Chrome vulnerabilities patched during 2026, including issues reported in February, March, April, June and September. The latest vulnerability brings the reported zero day total for the year to eight.

Google has advised users to update Chrome through the browser’s menu by selecting Help and then About Google Chrome. The browser will check for available updates and install the latest version. Users should select Relaunch when prompted and reopen the browser to ensure that the security fix has taken effect. Linux users should update Chrome through their package managers. Organisations are also advised to identify outdated installations, accelerate update deployment and verify that employees have restarted their browsers. IT teams should pay particular attention to devices that remain offline, fail to update or continue running unsupported versions. Users of other Chromium-based browsers should check their respective vendors’ security advisories for relevant fixes.