Google fixes the eighth actively exploited Chrome zero-day of 2026

A critical use-after-free vulnerability in Chrome's XML component (CVE-2026-125350) was actively exploited in the wild before Google could patch it, representing the eighth such zero-day in 2026 alone. Use-after-free flaws allow attackers to execute arbitrary code by manipulating freed memory, making them highly dangerous for end users running unpatched browsers. The sheer frequency of exploited Chrome zero-days in 2026 signals that threat actors are systematically targeting browser attack surfaces at scale. Organizations that delay browser updates — even by hours or days — expose their entire workforce to drive-by exploitation and credential theft. This incident underscores that browser patching must be treated with the same urgency as operating system or server patching.