Google patches exploited Chrome flaw in nine-vulnerability update

Google has released a Chrome security update addressing nine vulnerabilities, including a high-severity flaw it says is being exploited in the wild. The vulnerability, identified as CVE-2026-125350, affects Chrome’s XML component, and Google has not disclosed details about the reported attacks or who is behind them.

Google described the flaw as a use-after-free vulnerability. Such a bug can occur when software tries to access memory after it has been freed. The vulnerability description says a remote attacker could use a crafted HTML page to execute code within Chrome’s sandbox. Google has classified the flaw as high severity.

The company released Stable Desktop fixes for Windows and macOS in version 157.0.8103.50.51, and for Linux in version 157.0.8103.50. Google said the update rollout could take days or weeks to reach all Chrome users. The fixes are part of an update that patches nine vulnerabilities in total.

Google said it was aware that an exploit for CVE-2026-125350 exists in the wild. It has not identified affected users or systems, described how the flaw is being used in attacks, or named any perpetrators. The company said it may keep technical details and links...