Overview
- Google released Chrome 157 security updates on Monday to fix nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free bug in the browser’s XML component that Google says is being exploited in the wild.
- A use-after-free bug lets code access memory after it has been freed which can cause crashes, corrupt data, or let an attacker run arbitrary code if successfully exploited.
- Hong Kong’s HKCERT rated the risk from the patched flaws as Extremely High while CISA has not yet added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog.
- The desktop updates (157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux) are rolling out now and Google also released the same fixes for Android; users should check About Google Chrome and relaunch to apply the patch.
- This is the eighth Chrome zero-day patched in 2026, which raises pressure on other Chromium-based vendors such as Microsoft Edge, Brave, Opera, and Vivaldi to issue corresponding fixes and on users to update quickly to reduce exposure.