TechTurco WhatsApp ChannelOne-way channel: your number stays private
News
Emergency patch for Google Chrome: 8th actively exploited vulnerability fixed
Chrome engineers tracking security vulnerabilities and attacks released an emergency update for the Google Chrome browser, which is used by hundreds of millions of people.
Contents
Google released an emergency update to fix a high-severity security vulnerability in the Chrome web browser that was actively exploited by cyber attackers. It directly affects millions of users because a critical security flaw was resolved in the background.
Google released an emergency security update to address a new zero-day vulnerability actively used in cyberattacks on the Chrome web browser. The company announced that the detected vulnerability was confirmed to be exploited in cyberattacks. With this move, Google has patched the eighth zero-day flaw used in active attacks in Chrome since the beginning of the year.
Memory flaw in XML component allows code execution
The high-severity vulnerability, designated CVE-2026-125350, stems from a Use-After-Free (UAF) memory flaw in Chrome's XML component. The security vulnerability occurs when the browser's XML parser deletes an object from computer memory while processing data, but fails to clear the pointer referencing that object.
Reklam
Attackers can execute malicious code on the target system by manipulating the memory layout when the browser later attempts to read or use this freed memory space.
Details will be kept confidential until majority of users update
Google announced that it found evidence the security vulnerability was used in active attacks, but did not share incident details. In line with company policy, it stated that access to bug details and links will be kept restricted until a majority of users install the patch. It also noted that restrictions will persist if the bug exists in a third-party library that other projects depend on and has not yet been fixed there.
Update rollout begins for desktop users
The patch prepared for the zero-day flaw was released via the Stable Desktop channel. The new versions have begun rolling out to users on actively supported Windows, macOS (157.0.8103.50/.51), and Linux (157.0.8103.50) platforms.
Reklam
Be the first to know
Join our channel and get key developments straight on your phone.
TechTurco Telegram ChannelMute or leave any time
Although the update may take days or weeks to reach all Chrome users, the security patch can be installed immediately via a manual check. For users who do not wish to update manually, Chrome automatically installs the patch upon the next launch.
Other zero-day vulnerabilities patched since the beginning of the year
With this latest patch, Google has fixed a total of 8 zero-day vulnerabilities actively exploited in cyberattacks since the start of the year. Other vulnerabilities resolved during the year include:
| Date Patched | CVE Code | Affected Component and Flaw Type |
|---|---|---|
| Mid-February | CVE-2026-2441 | Iterator invalidation flaw in CSSFontFeatureValuesMap component |
| March | CVE-2026-3909 | Out-of-bounds write vulnerability in Skia 2D graphics library |
| March | CVE-2026-3910 | Inappropriate implementation flaw in V8 JavaScript and WebAssembly engine |
| April | CVE-2026-5281 | Use-After-Free flaw in Dawn component, the Chromium project WebGPU standard implementation |
| June | CVE-2026-11645 | Out-of-bounds read and write vulnerability in V8 JavaScript engine |
| September | CVE-2026-87491 | Out-of-bounds write vulnerability in V8 JavaScript engine |
| September | CVE-2026-85046 | Type confusion flaw in V8 JavaScript engine |
Google also patched 8 zero-day vulnerabilities actively used in attacks in 2025. Most of these flaws were detected by the Google Threat Analysis Group (TAG), which tracks zero-day exploits used in spyware attacks.
Reklam
This article was translated from Turkish. Read the original article in Turkish.
More in News
