Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026

A use-after-free vulnerability in Chrome's XML component (CVE-2026-125350) is being actively exploited in the wild, allowing attackers to corrupt data or execute arbitrary code on unpatched systems. This is the eighth actively exploited Chrome zero-day patched in 2026 alone, signaling that browser vulnerabilities are a persistent and high-frequency attack vector. Organizations that delay browser updates — even by days — expose users to real-world exploitation, since threat actors move quickly once a zero-day is known. The sheer volume of Chrome zero-days this year underscores the need for automated, rapid patch deployment rather than relying on manual update cycles.