Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

Google patched a high-severity zero-day vulnerability (CVE-2026-125350) in Chrome's XML component that was already being actively exploited before a fix was available, making it the eighth Chrome zero-day exploited this year. Zero-day vulnerabilities are particularly dangerous because defenders have no advance warning and no patch to apply at the moment of discovery, leaving users exposed until the vendor releases a fix. The repeated pattern of Chrome zero-days being exploited in the wild underscores that widely used browsers are high-value targets, and organizations that delay browser updates — even by hours — risk compromise. Rapid patch deployment and automated update enforcement are critical controls when zero-days are disclosed alongside active exploitation.