Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely

A critical use-after-free vulnerability in Google Chrome's XML component (CVE-2026-125350) was actively exploited by attackers to execute malicious code remotely before Google could deploy a fix, classifying it as a true zero-day. Use-after-free bugs are particularly dangerous because they corrupt memory in ways that allow attackers to hijack program execution with high reliability. The fact that exploitation occurred in the wild means real users were compromised during the window between discovery and patch release. Organizations that delay browser updates — even by hours or days — dramatically increase their exposure to these types of commodity attacks targeting widely-used software.