Google has fixed a Chrome flaw that attackers were already exploiting, BleepingComputer reported on 10 November. In a Monday security advisory, Google said it knows an exploit for CVE-2026-125350 exists in the wild. BleepingComputer describes the bug as a use-after-free flaw in Chrome's XML component. In plain terms, the XML parser frees a piece of memory but keeps a pointer to it. BleepingComputer says attackers can abuse that pointer later to run malicious code. It rates the flaw high severity and counts it as the eighth Chrome zero-day this year. A zero-day is a flaw attacked before a fix exists.
Google has not shared details about the attacks it found, according to BleepingComputer. Google also said bug details and links may stay restricted until most users have updated. BleepingComputer lists the fixed versions as 157.0.8103.50 and .51 on macOS and 157.0.8103.50 on Linux, with a Windows build also rolling out. Google says the rollout can take days or weeks. BleepingComputer found the update available at once when it checked. Who was targeted, how many people, and who is behind the attacks has not been made public.
Chrome is on most work computers, so a flaw that is already under attack touches many companies. BleepingComputer says Chrome installs the update by itself after the next launch. A machine where the browser stays open for days may therefore run the old version for longer.