Google patches Chrome’s eighth exploited zero-day of 2026

What the eighth zero-day measures

The earlier seven exploited Chrome vulnerabilities patched in 2026 spanned font handling, graphics, WebGPU and the V8 JavaScript engine. The latest XML defect extends that record into another browser component. The tally counts vulnerabilities, however, and gives no measure of the number of attacks or affected users.

The year-by-year account also puts Google’s 2025 total at eight patched zero-days exploited in attacks. Reaching that number again by November is a useful baseline, but cannot establish a change in attack frequency or individual users’ risk.

This Stable release also fixes six other high-severity vulnerabilities across WebGL, FileSystem, Compositing, GPU, V8 and XML, plus two medium-severity uninitialized-resource issues in GPU. Google discovered most of those other flaws internally, the release report says. The available reporting identifies active exploitation specifically for CVE-2026-125350.

Google’s Chrome Security Team illustrates the vulnerability lifecycle, ending with a browser restart to apply the update. Source: Google Chrome Security Team.

Confirm the fix for the channel in use

The corrected Stable desktop versions are:

There is also a separate fix for Extended Stable, the channel Google recommends for sensitive environments that need software changes vetted. Google’s November 9 release listing gives version 156.0.8078.96 for Windows and Mac and includes CVE-2026-125350 among its fixes. Administrators should check the browser’s channel as well as its version, rather than treating the Stable version number as the only evidence of remediation.

Google says distribution can take days or weeks, although the Stable update was already available during a reported check on November 10. Chrome can download updates in the background; restarting applies the staged update.

In a July 30 explanation of its security process, Google’s Chrome Security Team told users to click the update message in the top-right corner. It recommended that enterprise administrators use its relaunch-notification policy to prompt or require restarts. Google said delayed restarts contribute to exposure even after fixes have shipped.

The team also described how public fixes can let attackers reverse-engineer a vulnerability before the correction reaches users. It called this interval the patch gap and said it was piloting two security releases a week. These are distinct deployment steps: releasing corrected software and getting it running on users’ devices.

That earlier initiative does not reveal how these attacks began or how quickly this fix will reach every device. For users and administrators, the verifiable next step is to apply the appropriate channel’s update and confirm that the corrected browser is running. Assessing the attacks will require further disclosure about targeting, exploit delivery and the duration of exploitation.