Chrome zero-day patch: Google fixes XML parser use-after-free

Google has issued an emergency update to patch a new Chrome zero-day, CVE-2026-125350, a use-after-free vulnerability in the browser's XML component that has been observed in attacks. This release affects the Stable Desktop channel and new versions are rolling out for Windows, macOS, and Linux, according to reporting from BleepingComputer and The Hacker News.

BleepingComputer notes that Google told users it is aware of exploits in the wild. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," according to BleepingComputer. The company has not published further technical details about how attackers are using the bug.

Why this Chrome zero-day patch matters

Use-after-free vulnerabilities happen when a program removes an object from memory but later attempts to use the same memory reference. That mismatch can let an attacker alter memory layout and, in some cases, run arbitrary code inside the program process. Both BleepingComputer and The Hacker News describe CVE-2026-125350 as a high-severity memory corruption issue in Chrome's XML parser.

For small businesses, nonprofits, and public sector teams, a browser exploit is a practical risk because Chrome is commonly used for email, web dashboards, cloud consoles, and administrative tools. If an attacker can get code to run through the browser, they may be able to pivot from a worker's workstation to internal systems, depending on other controls in place.

Who is affected and how updates are rolling out

BleepingComputer reports Google patched the issue and pushed updates in the Stable Desktop channel. The company listed new desktop versions for Windows, macOS, and Linux, and said the update could take days or weeks to reach all users. BleepingComputer also observed the fix was available immediately when they checked for updates.

The Hacker News adds that an anonymous researcher reported the flaw, and it reiterates that Google acknowledged active exploitation but has not supplied details on the specific attacks. The Hacker News also reminds users of Chromium-based browsers, such as Edge, Brave, Opera, and Vivaldi, to expect similar fixes from their vendors when available.

If you manage devices centrally, expect a staggered rollout: Google often publishes updates to the Stable channel, then those versions propagate through update servers and enterprise management tools. BleepingComputer notes Google may restrict technical bug details until most users receive the patch, and it may keep restrictions if the bug stems from a third-party library used elsewhere.

Practical steps for small organizations and nonprofits

• Update desktop Chrome now, and restart the browser to ensure the patch is applied. Check More > Help > About Google Chrome to trigger an update. The patched versions were reported by BleepingComputer as the Stable Desktop releases for Windows, macOS, and Linux.
• If you run managed or shared devices, schedule an immediate update window and verify devices actually relaunch to finish installing the new version.
• Tell staff to avoid clicking links or opening attachments from unknown senders while you complete updates, since browsers are a common attack vector.
• Ensure automatic updates are enabled where practical so future fixes install without manual steps.
• Watch for vendor notices if you use other Chromium-based browsers and apply their updates as they appear.
• Review administrative access on endpoints and limit who can install or run unfamiliar software until you confirm systems are patched.

If you want a quick check of how exposed your public-facing site and services are, start with a free external scan here: /security.html.

What to watch for next

Google has patched multiple Chrome zero-days this year, and BleepingComputer lists this as the eighth actively exploited Chrome zero-day addressed since the start of the year. The outlet also notes Google fixed several zero-days in 2025. Because Google sometimes delays publishing full bug details until most users are patched, you may not see a full technical writeup immediately.

For defenders, that delay is a reason to assume active exploitation is ongoing until you confirm updates are applied. Continue monitoring official vendor channels for expanded advisories and keep your endpoint update policies configured to apply critical browser patches quickly.

If you use enterprise management tools, plan to verify update compliance across machines rather than relying on individual users. If you need help understanding your exposure or setting an update plan, consider coordinating with your IT or security provider and use the free external scan above to start a short assessment.

Sources: reporting from BleepingComputer and The Hacker News.