Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.
Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that freed memory space to manipulate the memory layout and execute malicious code.
While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared further details about these incidents.
Access to bug details and links may be kept restricted until a majority of users are updated with a fix.
Google has now fixed the zero-day for users in the Stable Desktop channel, with new versions rolling out to Windows, macOS (157.0.8103.50/.51), and Linux users (157.0.8103.50).
Although Google says the security update could take days or weeks to reach all Chrome users, it was available immediately when BleepingComputer checked for updates today.
If you don't want to update the web browser manually, you can also let Chrome check for updates on its own, as it will automatically install them after the next launch.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Since the start of the year, Google has addressed seven other actively exploited zero-day vulnerabilities: Google fixed eight more zero-days exploited in attacks in 2025, many of them reported by the company's Threat Analysis Group (TAG), which tracks zero-day exploits used in spyware attacks.
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.
We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed, it noted.
For optimal protection, users are advised to update their Chrome browser to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux.
What happened
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.
Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that freed memory space to manipulate the memory layout and execute malicious code.
What changed
While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared further details about these incidents.
Access to bug details and links may be kept restricted until a majority of users are updated with a fix.
Who is affected
Google has now fixed the zero-day for users in the Stable Desktop channel, with new versions rolling out to Windows, macOS (157.0.8103.50/.51), and Linux users (157.0.8103.50).
Although Google says the security update could take days or weeks to reach all Chrome users, it was available immediately when BleepingComputer checked for updates today.
Why it matters
If you don't want to update the web browser manually, you can also let Chrome check for updates on its own, as it will automatically install them after the next launch.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Technical details
Since the start of the year, Google has addressed seven other actively exploited zero-day vulnerabilities: Google fixed eight more zero-days exploited in attacks in 2025, many of them reported by the company's Threat Analysis Group (TAG), which tracks zero-day exploits used in spyware attacks.
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.
Response
We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed, it noted.
For optimal protection, users are advised to update their Chrome browser to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux.
What security teams should do
Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.