Check for updates now! A high-severity zero-day vulnerability has been exposed in Chrome and has already been exploited by hackers; officials have urgently released an update to patch it.

In this AI era, every few days we hear news that some company or website has had customer data stolen or been hacked, so everyone really needs to raise their security awareness. If you’re a Chrome user, you must upgrade to the latest version as soon as possible, because this version fixes a “zero-day vulnerability” that officials have confirmed attackers are exploiting in real-world environments. Although it’s unclear how broad the impact is, I still recommend taking 30 seconds now to confirm that the update has been completed.

This is also already Chrome’s 8th zero-day vulnerability of 2026, with patches available for all three platforms: Windows, macOS, and Linux.

Image source: Bleeping Computer

Chrome’s 8th zero-day vulnerability this year! Google confirms it has been exploited by hackers; Windows, Mac, and Linux users should check for updates now.

According to foreign media Bleeping Computer According to reports, a few days ago Google published a “Desktop Stable Channel Update” on the official Chrome Releases blog. The Windows and macOS versions are 157.0.8103.50/.51, and the Linux version is 157.0.8103.50, fixing a total of 9 security issues. Among them, the vulnerability numbered CVE-2026-125350 was rated High by Google, and the official announcement directly states that Google is aware that an exploit for CVE-2026-125350 “exists in the wild.”

A so-called zero-day vulnerability is one that attackers are already exploiting before the vendor releases a patch, leaving developers zero days to respond. That makes patching this type of vulnerability more urgent than ordinary security updates.

CVE-2026-125350 is a Chrome XML component. XML is a text format that uses tags to organize data. It is used in SVG vector graphics on web pages, RSS subscription content, and data exchanged between many websites and web services. The browser’s built-in XML parser is responsible for reading this content and organizing it into a structure that programs can process, making it a foundational component that works every day.

The vulnerability type is Use-After-Free (UAF), which is a memory safety issue.

So how would it actually be attacked? A common method is to prepare a specially crafted webpage, or hide specially crafted content in webpages, ads, or links, and lure the target into opening it with Chrome, thereby triggering a memory error. Once the memory error is triggered, roughly the following situations will occur.

At the mildest, the tab or browser simply crashes and the attack fails, with users at most finding the webpage acting strange. But if the attacker arranges the memory contents just right, they can get Chrome to execute code they have prepared, and at that point there is a chance to read data being processed by that page, such as what you are typing or your login status.

If the attacker takes it one step further and combines it with a “sandbox escape” vulnerability, they could install spyware or other malware on your computer—and the user usually won’t notice anything during the entire process.

As for who is exploiting it, who was attacked, how large the impact was, and how it was triggered, Google has not disclosed any of this so far.

However, this is also Google’s standard practice when handling exploited vulnerabilities: details and related links are withheld and only made public after most users have completed the update. The reason is simple: to prevent the details, once exposed, from being exploited by more attackers.

This update also patches vulnerabilities in components such as WebGL, the file system, compositing, GPU, and the V8 engine. Most were discovered internally by Google, and only CVE-2026-125350 is marked as having been exploited.

Open Settings -> About Chrome, and it will automatically check for updates, then restart Chrome:

I’m on Mac, so as long as it’s confirmed to be version 157.0.8103.51 or later, there’s no problem:

Below are the 8 zero-day vulnerabilities Chrome has patched this year that have been exploited:

Source: KOCPC Chinese