Google patches eighth Chrome zero-day exploited in attacks this year

Google was forced to issue an emergency patch for CVE-2026-125350, a Use-After-Free vulnerability in Chrome's XML component that was actively exploited in the wild — the eighth such zero-day in Chrome this year alone. Use-After-Free flaws allow attackers to execute arbitrary code by manipulating freed memory, making them highly dangerous for browser-based attacks targeting end users. The relentless cadence of Chrome zero-days demonstrates that threat actors are continuously probing widely deployed software for exploitable weaknesses. Organizations that delay browser updates even briefly create windows of opportunity that sophisticated attackers are actively exploiting. Timely, automated patching of end-user software is no longer optional — it is a critical defensive baseline.