Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year with nearly two months still left on the calendar. The latest flaw, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome’s XML component. Google confirmed in a security advisory published Monday that attackers are already exploiting the bug, although it hasn’t said who’s behind the attacks or who might be getting targeted. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said, offering little else about the attacks. The vulnerability was reported anonymously on November 6 and involves a memory management error that occurs when software continues using a pointer to memory that has already been freed. Such bugs can potentially allow attackers to corrupt memory and execute malicious code, although Google hasn’t disclosed how this particular flaw is being exploited. Google is keeping further technical details under wraps until enough users have installed the fix, a familiar approach intended to stop other attackers from getting their hands on a working exploit. The patch arrives in Chrome 157. 0. 8103. 50/. 51 for Windows and macOS, and 157. 0. 8103. 50 for Linux…