Chrome's Eighth Zero-Day of 2026: Why Browser Patching Deserves Consistent Attention

Google has released a security update for Chrome addressing nine vulnerabilities, including one — CVE-2026-125350 — that is already being actively exploited in the wild, according to SecurityWeek. The vulnerability is a use-after-free bug in Chrome's XML component, reported anonymously on 6 November with a patch following within days. Use-after-free flaws occur when a programme attempts to access a memory location after it has already been freed, and they can allow attackers to execute arbitrary code on a victim's device. This is the eighth actively exploited zero-day patched in Chrome during 2026, a figure that reflects the browser's consistent status as a high-value target for attackers.

Why this matters for UK organisations

Chrome is one of the most widely deployed applications across UK workplaces, used by employees across virtually every sector for day-to-day work. Use-after-free vulnerabilities are particularly concerning in a browser context because they can be triggered simply by visiting a malicious or compromised web page — no additional user interaction, file download or credential entry is required. This means the barrier to exploitation is low, and the potential for widespread impact is high. The frequency of actively exploited zero-days in Chrome this year — eight in under eleven months — is a useful signal that browser patching should be treated with the same urgency as operating system and application patching, rather than being left to users to manage individually or deferred within extended patch cycles. Organisations that rely on manual update processes or that have not verified automatic updates are functioning correctly may be carrying unnecessary exposure.

What to review

IT and security teams should verify that Chrome is configured to update automatically across all managed devices, and confirm that the latest patched version is being deployed without delay. Where Chrome is managed centrally through endpoint management tooling, check that browser updates are included in your standard patch deployment process and are not being inadvertently excluded or deferred. Organisations should also consider whether their patch management reporting provides visibility into browser versions across the estate, not just operating system and server patch status. For organisations with a mix of managed and unmanaged devices — including remote workers using personal equipment — this is a prompt to review whether browser update policies extend to those endpoints and whether guidance is in place for users who manage their own devices.

Source: SecurityWeek