Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026

According to coverage from outlets including The Hacker News, PCWorld, CyberSecurityNews, Rescana, and the Hong Kong Computer Emergency Response Team Coordination Centre, Google has released a security update for the Chrome browser to address multiple vulnerabilities. The primary focus of the coverage is a use-after-free vulnerability identified in XML, cataloged as CVE-2026-125350. Reports specify that an exploit for this security flaw already exists in the wild. According to the available sources, this particular issue allows malicious actors to execute arbitrary code remotely on targeted systems.

Additional details provided by PCWorld and other reporting sources indicate that the wider Chrome 157 update addresses over two hundred security flaws in total. Among these resolved security issues, seven are classified specifically as critical vulnerabilities. The Hong Kong Computer Emergency Response Team Coordination Centre also issued advisories regarding these multiple vulnerabilities present within the browser software, emphasizing the broad scope of the security patch released by Google to protect users from ongoing threats.

The Hacker News highlights that this security update marks a significant milestone for the browser manufacturer, representing the eighth actively exploited zero-day vulnerability that Google has been forced to address throughout the year. The recurring nature of these use-after-free bugs and remote code execution risks provides essential context regarding the persistent security challenges facing widely used web browsers and the continuous need for rapid patching mechanisms by technology corporations.

As the situation develops, readers and system administrators must monitor future advisories from Google and cybersecurity authorities to ensure all affected browser installations are successfully updated. Coverage does not yet specify the full extent of the attacks utilizing CVE-2026-125350, nor does it detail specific threat actors. Subsequent updates from the reporting outlets will likely provide further technical analysis regarding the scope of the remote code execution exploits observed in the wild.