Summary

Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after

For more information, read the full story at the original source: The Hacker News ↗

Vulnerabilities in this story

• CVE-2026-11645 KEV · fix by 2026-06-23 Google Chrome EPSS 2.4% 8.8High
• CVE-2026-2441 KEV · fix by 2026-03-10 Google Chrome EPSS 54.4% 8.8High
• CVE-2026-3909 KEV · fix by 2026-03-27 Google Chrome EPSS 2.3% 8.8High
• CVE-2026-3910 KEV · fix by 2026-03-27 Google Chrome EPSS 2.6% 8.8High
• CVE-2026-5281 KEV · fix by 2026-04-15 Google Chrome EPSS 13.7% 8.8High
• CVE-2026-85046 KEV · fix by 2026-09-18 Google Chrome EPSS 1.8% 8.8High
• CVE-2026-87491 KEV · fix by 2026-09-23 Google Chrome EPSS 3.5% 8.8High

Also reported by

• SecurityWeek: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year ↗
• BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year ↗