Overview
- Google released emergency Chrome 157 on Monday to patch nine vulnerabilities, including the actively exploited CVE-2026-125350.
- CVE-2026-125350 is a high-severity use-after-free flaw in Chrome’s XML parser that can corrupt memory and allow arbitrary code execution.
- Google says an exploit for the bug exists in the wild and is keeping technical details restricted until a majority of users install the fix; CISA has not yet added the CVE to its KEV catalog.
- Users should update Chrome now via More > Help > About Google Chrome and watch for matching updates from Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi.
- This is the eighth Chrome zero-day reported as actively exploited in 2026, a pattern that raises urgency for faster patch rollouts and tighter monitoring by organizations and browser vendors.