Overview
- Google issued emergency Chrome 157 updates on Monday that fix nine security flaws, including an actively exploited zero‑day tracked as CVE-2026-125350.
- The flaw is a high‑severity use‑after‑free in Chrome’s XML component, a memory bug that can let attackers corrupt data, crash the browser, or run arbitrary code if exploited.
- Google says an exploit exists in the wild but has not released technical details until more users are patched, and Hong Kong CERT rates the risk as “Extremely High” while CISA has not yet added the CVE to its KEV list.
- The fixes are rolling out to Windows, macOS, Linux and Android in Chrome 157.0.8103.50/.51 and users can speed protection by checking About Google Chrome and relaunching to apply the update.
- This is the eighth Chrome zero‑day reported as actively exploited in 2026, a pattern that raises pressure on Chromium vendors and administrators to apply corresponding patches quickly.