Google has released an urgent security update for Chrome after confirming that a vulnerability in the browser’s XML component is being actively exploited in the wild. The flaw, tracked as CVE-2026-125350, is a use-after-free memory corruption issue that could allow an attacker to execute arbitrary code on a victim’s system. With a working exploit already circulating, the message from TechNews DevTop is unambiguous: update Chrome today, not tomorrow.
- Actively exploited: Google confirms an exploit is in circulation, making this a live threat rather than a theoretical risk.
- Eighth zero-day of 2026: This marks the eighth Chrome vulnerability exploited in the wild this year, highlighting an accelerating pace of attacks.
- Patch now: Users need Chrome 157.0.8103.50/.51 on Mac or PC (157.0.8103.50 on Linux); Chromium-based browsers like Edge, Brave, and Opera require their own updates.
What the Flaw Allows and Why It Matters
The vulnerability is a classic use-after-free bug in Chrome’s XML handling. In simple terms, the browser frees a region of memory but later attempts to access it, creating a window that an attacker can exploit to run their own code. Google’s confirmation that an exploit is “in circulation” elevates the severity: someone has already used it against a target, putting every Chrome and Chromium user at risk.
This is not an isolated incident. It is the eighth actively exploited flaw Chrome has patched this year, a statistic that underscores how 2026 has seen a surge in vulnerability discovery—accelerated on both sides by artificial intelligence. The same week, Android patched critical zero-click vulnerabilities, Apple fixed two iMessage flaws, and Microsoft’s Patch Tuesday delivered more than 1,400 fixes. The broader ecosystem is under sustained pressure.
Which Version You Need and What About Edge, Brave, and Opera?
To close the hole, you must be running at least version 157.0.8103.50/.51 on Mac or PC, or 157.0.8103.50 on Linux. Google published the update on Monday, addressing nine security issues in total, including this exploited one. To check your version, click the three-dot menu in the top-right corner of Chrome, go to Help > About Google Chrome, and the browser will update automatically if a new version is available.
The nuance matters for those who do not use Chrome directly. Microsoft Edge, Opera, Brave, and other Chromium-based browsers share the same engine and therefore the same vulnerability, but each depends on its own vendor to ship a fix. This is yet another reminder that browser updates are not optional—a lesson that applies equally to any device with a pending security advisory.
“The concern is not this specific flaw, which is already patched, but the pace. Eight active exploits in a year in the world’s most used browser paint an increasingly fast race between those who find holes and those who patch them, and AI has stepped on the accelerator on both sides.”
The good news is that Chrome updates almost automatically. The bad news is that many people postpone the restart that applies the patch, leaving the door ajar just as someone is testing the handle. You do not need to understand what a use-after-free is to do the one thing that matters here: close and reopen your browser so the update takes effect. Today, not tomorrow.