Google is telling Chrome users to update now, and this time the urgency is not theoretical. On November 9, the company shipped an emergency update fixing CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component — and, according to Malwarebytes, Google says an exploit for it already exists in the wild.

The timeline is brisk even by Google's standards. An anonymous researcher reported the flaw on November 6; the fix landed three days later in Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and the same build for Android, plus an Extended Stable release for managed machines. The update carries nine security fixes in total, but the zero-day is the one that matters — a use-after-free bug lets an attacker corrupt the browser's memory, and in the worst case run their own code after luring a victim to a malicious page.

What Google isn't saying is almost as notable as what it is. The company has not named the attackers, the targets, the delivery method, or what the exploit can do, and the underlying bug report stays restricted until most users have patched. As of today, CISA has not yet added the flaw to its Known Exploited Vulnerabilities catalog. Hong Kong's computer emergency response team, meanwhile, rates the overall risk "extremely high."

Then there's the count. This is the eighth Chrome zero-day Google has confirmed as exploited in the wild in 2026, following seven others patched across the year, per GBHackers. Eight in eleven months is not a blip — it's the cadence of the world's most-targeted browser, where the researchers who find the bugs and the attackers who exploit them are effectively racing the same clock.

The practical part is the easy part, and it's also the part most people skip. Chrome updates itself, but only when you actually close it — a browser left open for weeks is a browser left unpatched. Open Help → About Google Chrome, let it check, and hit Relaunch when it prompts you. The rollout is staged over days, so if the fixed build hasn't reached you yet, check again rather than assuming you're covered. The exploit is already out there; the patch is too. The only question is which one reaches your machine first.

— via Malwarebytes