This Actively Exploited Chrome Vulnerability Is Putting Your Browser at Risk

Jake Peterson Jake Peterson Senior Technology Editor ExperienceJake Peterson is Lifehacker’s Tech Editor, and has been covering tech news and how-tos for nearly a decade. His team covers all things technology, including AI, smartphones, computers, game consoles, and subscriptions. Read Full Bio November 10, 2026 Add as a preferred source on Google Add as a preferred source on Google Credit: Nikolas Kokovlis/NurPhoto via Getty Images Key Takeaways If you use Chrome, or a Chromium-based browser, your browser is vulnerable to an actively exploited security flaw. CVE-2026-125350, a use-after-free flaw, allows for arbitrary code execution. Google says it is aware that an exploit for this security flaw exists in the wild. Chrome users can update their browsers today, but Chromium-based browsers will need to roll out their own updates. Table of Contents If you've seen an uptick in security updates as of late, you're not alone. AI models have become very good at finding new security vulnerabilities throughout 2026. Researchers and hackers alike are increasingly relying on these models in their individual pursuits: Hackers want to find these flaws to exploit them, while researchers want to block hackers from doing so. Microsoft's latest Patch Tuesday update included more than 1,400 patches; meanwhile, Apple's latest security update fixed two iMessage flaws that let both bad actors and innocent parties alike access texts they shouldn't. Whether you use a Mac or a PC, you probably browse the web with Chrome, or a Chromium-based browser. As it happens, Google's web browsing platform is the latest to receive an important security update—but it's far from the first important Chrome update of the year. Google just patched its eighth actively exploited Chrome flaw of 2026As reported by The Hacker News, Google released a new update for Chrome on Monday that patches nine security flaws. While all vulnerabilities are important to patch, one in particular is more serious than the rest: CVE-2026-125350, a use-after-free bug in Chrome's XML component. Use-after-free vulnerabilities happen when the system frees up a memory location, but a program tries to access it anyway. It's a glitch in programming, but it offers bad actors an opportunity to break into your system. At worst, it allows arbitrary code execution, or, in other words, gives hackers the ability to run their own code in the app or system. That's bad enough on the surface, but, unfortunately, Google confirmed that CVE-2026-125350 has an active exploit in the wild. The company is keeping other details close to the vest, but it's dangerous nonetheless. At least someone, somewhere, has used this flaw against a target, which puts all Chrome users (as well as users of Chromium-based browsers) at risk. What do you think so far? What's more, this isn't Chrome's first active exploit of the year—this is its eighth. The company is playing catch-up with hackers looking to target users of its browser, which makes sense, seeing as Chrome is by far the world's most popular browser.How to patch this latest Chrome flawIf you're using Chrome on your computer, you'll want to update it as soon as possible. Make sure you're running at least versions 157.0.8103.50/.51 on Mac or PC, or 157.0.8103.50 on Linux. To check, click the three dots in the top-right corner of your Chrome window, then go to More > Help > About Google Chrome. Other Chromium-based browsers may not have the update yet, but they are affected by this flaw. If you use browsers like Microsoft Edge, Opera, or Brave, keep an eye on your updates to install any of the latest patches. Lifehacker has been a go-to source of tech help and life advice since 2005. Our mission is to offer reliable tech help and credible, practical, science-based life advice to help you live better. Our Mission Our Team Newsletter © 2001-2026 Ziff Davis, LLC., A ZIFF DAVIS COMPANY. ALL RIGHTS RESERVED. Lifehacker is a federally registered trademark of Ziff Davis and may not be used by third parties without explicit permission. The display of third-party trademarks and trade names on this site does not necessarily indicate any affiliation or the endorsement of Lifehacker. If you click an affiliate link and buy a product or service, we may be paid a fee by that merchant.