Google Patches Eighth In-Wild Chrome Zero-Day CVE-2026-125350 XML Use-After-Free

The update addresses nine flaws total. CVE-2026-125350 was reported November 6 by an anonymous researcher; Google confirmed in-the-wild exploits without disclosing targets or actors. Use-after-free in XML parsing enables memory corruption and code execution, a recurring vector in browser and document processors. Prior 2026 cases (CVE-2026-2441, CVE-2026-3909, CVE-2026-5281, CVE-2026-85046) cluster around parsing libraries and renderer components. Contract awards and job postings at major vendors show sustained investment in XML and media decoders, indicating defenders anticipate continued abuse of these surfaces. Chromium-based browsers inherit the risk; delayed downstream patches extend exposure windows. Official statements withhold actor attribution and exploit details until uptake thresholds are met, limiting independent verification of scope. Procurement records and prior incidents suggest state and criminal groups prioritize browser zero-days for initial access. Expect rapid re-use of the same XML primitive against unpatched enterprise fleets within weeks.