If you use Chrome or a Chromium-based browser, update it: Google has patched nine security flaws, and one of them, CVE-2026-125350, is already being exploited.
The fixed versions are 157.0.8103.50/.51 on Mac and Windows, and 157.0.8103.50 on Linux. To check, click the three dots in the top-right corner, then go to More > Help > About Google Chrome. The page shows your version and downloads the update if you are behind.
The bug is a use-after-free flaw in Chrome's XML component. That means the browser frees a chunk of memory, then a program tries to use it anyway. In the worst case, an attacker can run their own code inside the app, which is why this class of bug draws attention. Google confirmed an exploit exists in the wild, so at least one target has already been hit. The company has kept other details to itself, including who was targeted and how.
This is the eighth actively exploited Chrome flaw Google has patched in 2026. Chrome is the world's most popular browser, which makes it the obvious place for attackers to spend their effort. For users, that turns the update check from an occasional chore into a routine.
Chromium-based browsers share the flaw. Microsoft Edge, Opera, and Brave may not have the fix yet, so check their update pages too.
There is a wider backdrop. AI models have become good at finding vulnerabilities this year, and patch volume has climbed: Microsoft's latest Patch Tuesday carried more than 1,400 fixes, and Apple recently patched two iMessage flaws that exposed texts. That surge is background for this story, not an explanation of it, since this bug has not been linked to AI-assisted discovery.
What remains unanswered is who used CVE-2026-125350, and against whom. Until Google says more, the version number is the one thing a user can verify.