# Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026

> **Open Intelligence Dossier** · First detected: 2026-11-10 09:00 UTC · Category: Technology

## Executive Summary
Google issues an urgent Chrome security update to address an actively exploited zero-day vulnerability.

## Intelligence Brief
According to coverage from outlets including The Hacker News, PCWorld, CyberSecurityNews, Rescana, and the Hong Kong Computer Emergency Response Team Coordination Centre, Google has released a security update for the Chrome browser to address multiple vulnerabilities. The primary focus of the coverage is a use-after-free vulnerability identified in XML, cataloged as CVE-2026-125350. Reports specify that an exploit for this security flaw already exists in the wild. According to the available sources, this particular issue allows malicious actors to execute arbitrary code remotely on targeted systems.


Additional details provided by PCWorld and other reporting sources indicate that the wider Chrome 157 update addresses over two hundred security flaws in total. Among these resolved security issues, seven are classified specifically as critical vulnerabilities. The Hong Kong Computer Emergency Response Team Coordination Centre also issued advisories regarding these multiple vulnerabilities present within the browser software, emphasizing the broad scope of the security patch released by Google to protect users from ongoing threats.


The Hacker News highlights that this security update marks a significant milestone for the browser manufacturer, representing the eighth actively exploited zero-day vulnerability that Google has been forced to address throughout the year. The recurring nature of these use-after-free bugs and remote code execution risks provides essential context regarding the persistent security challenges facing widely used web browsers and the continuous need for rapid patching mechanisms by technology corporations.


As the situation develops, readers and system administrators must monitor future advisories from Google and cybersecurity authorities to ensure all affected browser installations are successfully updated. Coverage does not yet specify the full extent of the attacks utilizing CVE-2026-125350, nor does it detail specific threat actors. Subsequent updates from the reporting outlets will likely provide further technical analysis regarding the scope of the remote code execution exploits observed in the wild.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| SecurityWeek | Chrome, Firefox Updates Patch Over 180 Vulnerabilities | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxPTHp6MmVGQ1NubTU1QThJWkVienZ6Tk4xSTBRUHo2U0pMTkxXSVdwTFpMUVRWVXM4QlR2b3lnU0pXOGNxYnpoOGx6cHljeEFSZmhubEhkRGExWHoxN2xzVzh1WEtkTlFkSkx5SXJTVkpybFJlNUVkcHRMeFJkVXpNYXV5VXo?oc=5) |
| Chrome Unboxed | Chrome 157 rolls out to Android and desktop, but Googlebook updates remain delayed | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxOQXNESWVqUUg0RzJOZmc2UEswOF9EOTcyWDlQcU4tV2wtaHFvWEd1RUJaSmJOck04TzB2VzQ4cVdKN1R3amwzNlN4dFBDT3ZrNmduNVVjQVdWb1pfSWNqS2JSeHctcjJCWlNIbmhXMzJjMTBMOVVVaHBuMmRjMVR5NkdTaGhnRFJJSHlmLW40Q2trSVppbVltY2NOckp2WURRZHppZHk3UUxtY0hH?oc=5) |
| YourStory.com | CERT-In flags critical security flaws, urges Chrome users in India to update browsers | [Source Link](https://news.google.com/rss/articles/CBMiqAFBVV95cUxQaDkwNW54dnJIcU9QTk5WVXQ1VGtNR3prU3d2clJheVN5VTZyQ2Fnd3lDMFJJcWg2T2hFU0RjaFJRM0x0RjZTNVhOcGdjd0FiOG1TT1l0VFpqWUhXUEdGWmhncDY5OHNwTGZPMlRXZ0JqSzFKN3hEdU1KcHpkVUpQXzZtSmJBSHhrUERuZW1kSzZLelJ0ekJVZThfZzlOVmhaWXlaYUJIbTY?oc=5) |
| Security Affairs | Google fixes the eighth actively exploited Chrome zero-day of 2026 | [Source Link](https://news.google.com/rss/articles/CBMivAFBVV95cUxOVU53TERhWUY2TTdtNnBObldjT1p4OWFsVmJaVmVvbmtKYVREdUJUcV9FQzVsVFoxSUM5eGNNeEtqY1pBN0RQdnI5b200UlFiNzVTczE2VVIwN2paMFpaR0lTQXNSSUxNcE4zdE96VzdiMkFYOFdqYlpXNEt4N3dnWmVCRmhCcEJGOHgxOU5oZTEtNmgzZi1WcjVaSXBhQnBFbHl2TGs5QmJjSXdCLVIxVXJKWUVyNDhvdHRpQ9IBwgFBVV95cUxQZ3BhVUpLNWhTN3ZxRkpjSmtxU1pYNjIzOVd5M2NZQVdQS21YUUJGbGZKT01aRFhQWXRIQjhEYTNUbXRGVWdMMmFMTWRsMFZ4a2ZXTWVSSjU5Um5YS0NWbUJua0t4WXlYc0NvSld6MjlITExKT01MTmpnUDhVaWt2UUFRdVRWSXlnd1B3UHJ5Ml84d0diVlQ) |
| Lifehacker | This Actively Exploited Chrome Vulnerability Is Putting Your Browser at Risk | [Source Link](https://news.google.com/rss/articles/CBMiqAFBVV95cUxNQldlOHlDNm8zenFmUWx6QmdCX3B1VFpUdk00N3o1aXBWZWQyWXNpZ3dQNkVFRjVfUEprNjEzU2VITWpOMzZCdW1fS1ZDOWtOZm81X25fSU5XMFNJMERwYzZwb09jY1kzSXVGZWstczRBQzctV3lSSUtMT05udmI2NWh2UFBiZXdadVQtSXhXTGNIU2hjUHV6WnpGeVRjNnVJREJnTVNrcGk?oc=5) |
| SecurityWeek | Chrome Update Patches Exploited XML Zero-Day, Eighth This Year | [Source Link](https://news.google.com/rss/articles/CBMilgFBVV95cUxPTGdQVTEybDU5Q0xodlpvcGpKOU5OaTVrOFQ0bUZQaGVDcnN3LXpqN3lkWFVpaUVmZElKS0VFSG9XRVF0YXZ2ektYckFhZFhTcVA2ckdNTHdyaEZzVFVBSUFqSXBKdHViNnN3U05OMzlfczRGQmFYajIzRFRMWWg5WFdzcVVsZ29NQzYwMTBMWE5OSlpSOGc?oc=5) |
| The Register | Chrome zero-day whack-a-mole continues as 2026 tally hits 8 | [Source Link](https://news.google.com/rss/articles/CBMitgFBVV95cUxOeHFhLWhoejdzQ2ZhejB0ZmRrWlVweVc4WXB0cFExY19YZWFoN2hrYmFoV3VwRFdiZXRzTFYtakhGWVBxOVFhNVo0dElwSVpEZzQ2dVJDTXV3TjdocV80VVI5R1k1bjByQmpSUkd6VWNyNzlDSTUyeDB1MjU0MEdMZ3VKNW5IWndSY3YzUjlSUDRYMEJfY2JWaVJJSTg3dVJDU0JPNHA1VXJhdkVfM19oOWU3eUJpdw?oc=5) |
| Malwarebytes | Update Chrome now to fix a flaw attackers are exploiting | [Source Link](https://news.google.com/rss/articles/CBMipgFBVV95cUxNdU15cHdKTUZCd3dZaFNnOEt3c2dYQl9udmxxSHN0QzgtQi1QOGJGMzNRdUtQb3FfN010RTE1NmpmcWxfQ2pfWTJpdHFJRC1yUkFvV3dfbTFPUld4NDk1ZFJBbnd1eEZ1MHktTWdCU0dkdzZHU3pkX250bXRLeTVTVzdweVk0UWN5SlFPQ09Dd3llb2F6bUx4M2RmMXVpZkc1V2lJeW13?oc=5) |
| CyberInsider | Google fixes Chrome XML zero-day flaw exploited in attacks | [Source Link](https://news.google.com/rss/articles/CBMidEFVX3lxTE92eDN4LVMwVlQ1UDE3QkppR05ha0h4cjA2S29xVDF1dTBSN0NSZkxhTzhleUl4R3A5UFQ2UFExLTVBcS1vQnh2SHJWRmZILUlNNk5VNEdYWlhXN3c4U2FNNHk2OEN2T19YM1ExWWtLMFhuRTht?oc=5) |
| 2-Spyware | Google Chrome 157 fixes eighth exploited zero-day of 2026 | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE5DeFJiN1dGb1ljV3dZVFRqUGxZaUMybURvWG5Ha2NWbGVIRnlMUTljTndEbEFuSkpYOFY1NDJ1dEFjVEw1ZUhBSDdPR3FOaVNLcll1RW1vRWFTbXR1RmFJWWFJMU00WDdFRE1OanV0T3plM0dPNVdsQUJTanIydw?oc=5) |
| heise online | Chrome update patches actively exploited security flaw | [Source Link](https://news.google.com/rss/articles/CBMingFBVV95cUxPODJ1LXJkQ2FBTzU5RkZxc2VBZHNvT2tvcXZlQVRHd0ItMnZLWV82akZlN3V0YVBmZmVzVkx5dGhuT1dmSDM1Y085M3NqVTFSVk5Kb2VaazNZZ0laM3o0M3NKXzFmZ3B5XzRSc21UOUtOeVAxTk1BSHhhUkU1VFRCRDBtZVlvRjJEbzhmN2N5NHVOczJnN2VLejFaZDFfQQ?oc=5) |
| BleepingComputer | Google patches eighth Chrome zero-day exploited in attacks this year | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxNcXB2Z25FRjBvOVdScHVNcDdxMnZQZlVkajl4UmJ2TmVIRkdkMFB2MXFwcXlhcVFGVVdFb2c0UVhMS3JpMTd4My1xSXF6YmwzalhIZVFmTHJXMU9tYVN3cE1oT0lXSUp6QXNVWW9HOTVpcXN6Z2JYX2N6c1RLUHRRSUtHY3NsanVtdXhCaXRENjVjTnJkb2RvZS0yN3Fud2RuOHY0OWFRdnpXZjhJUWdLQ0t4N2s0Y3PSAbwBQVVfeXFMT3ZlaXNkQzBpMEFJYkI4VGJQS095YXFxVUwzRjVFWlhpVm5nVHBmZ2tLUE5QZWNIYjdWdGVsY3ZOb0wzQ25MUnFhNnpDendsMmpsS014M01pWVB0YzRieVMwTXhGNUs4NUhQaUx2VVJYWTB6a1NMd2NIQUhFMmRVSDV3NFZweS1MMXlSdlRCRUpoMmh6OURNNEE3LXJ) |
| Rescana | Google Chrome CVE-2026-125350: Use-After-Free in XML, Exploit Exists in the Wild — Patch Now | [Source Link](https://news.google.com/rss/articles/CBMingFBVV95cUxNNjcxSnAwRTZBVzlRc0s5UWdWLTEzU0dKb0tyYVNwTlB1dVlmUXM3a2RFMHFOYjl0ZC1VSUJUQWVUZnliNG5LOUMzWjhnaUJWSzFPS3BuV1ZBRFRSZy1zaXdvcnBjWFB5WjJUbmZsM2dmTXhFMlg5c2FHeTcxdEl3eVd4WVNQbDY3amlHSVFBN2VnaDRpa1VNNUxPaThJZw?oc=5) |
| PCWorld | Chrome 157 fixes over 200 security flaws, 7 of them critical | [Source Link](https://news.google.com/rss/articles/CBMipwFBVV95cUxPblV0UGJKaDZjNEE3M2FtWnFGaGw4NXgwZnZFRGk0Tm4xMGJGUWJmV0pRTDByRVhGeTJwNlFSQ0tzRUFVZktjQkUzYlFhVWZHdXBVSjA3SkFIME9jTVRSOHA3TGZHQkh2TnQ3MTkxYjU1Snk2bmlMdG54eUZxUFpVZ1RWZzBER3dHTWJGVzR1c0hOcEhyWWlSMWhhTEpoM2pxSmhTdFFsRQ?oc=5) |
| CyberSecurityNews | Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely | [Source Link](https://news.google.com/rss/articles/CBMibEFVX3lxTE8wQjZiLTgzcks3NzBQa0pTRWtKSFNpYWN0Qld0dndhbkhGR1pKdElZWG9MdFhueVgtWnRtVTFKdjlDTHl2bWhXMklaUWxRWnRqUW12WWRSemNiNnZsWl9YcjYzaTRHZXFWS0RuSNIBckFVX3lxTE5qZVNkS3U4TW5ndnZmbk5IRVdJTnZXSzZrR1dzckV3VTdUWmtPNkhUUW1LbE9VUTg3by03M2wtdU9pY0hiVHNuUi10bkZIc1lhRGlHLXlfX1VSMWNQSDRFQ2NORncyUjlUcFFZeU9wcWNiZw?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-11-10/google-issues-chrome-security-update-for-eighth-actively-exploited-zero-day-of*