Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Chrome 157 patches exploited XML use-after-free, CVE-2026-125350

Original title: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

SecurityWeekby Eduard Kovacs ()1 min read
Read at securityweek.com
Part of a story covered by 7 sourcesGoogle patches exploited Chrome XML use-after-free, eighth 2026 zero-dayMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Windows and Mac builds 157.0.8103.50 and .51, and Linux 157.0.8103.50, include the fix.

Google released Chrome 157 updates patching nine vulnerabilities, including an in-the-wild use-after-free in the XML component tracked as CVE-2026-125350 and rated high. An anonymous researcher reported it on November 6. Google gave no details on the attacks, and CISA has not added the CVE to its KEV catalog. The release also fixes six other high-severity bugs and two medium-severity GPU issues.

Unconfirmed: Google has not described the attacks exploiting CVE-2026-125350.

Key facts
  • Fixed builds are 157.0.8103.50 and .51 for Windows and Mac.
  • Linux is fixed in 157.0.8103.50.
  • Six other high-severity bugs affect WebGL, FileSystem, Compositing, GPU, V8, and XML.
  • Two medium bugs are uninitialized resource issues in the GPU component.
  • This is the eighth exploited Chrome zero-day reported this year.
Security assessment · AI, from the articleExploited in the wild

Impact: In-the-wild exploitation of a high-severity browser use-after-free

ProductAffectedFixed in
Google Chrome—157.0.8103.50/.51 for Windows and Mac; 157.0.8103.50 for Linux
What to do
  1. 1.Update Chrome to 157.0.8103.50/.51 on Windows and Mac, or 157.0.8103.50 on Linux.
Analyze CVE-2026-125350 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-125350
Tags
chromegooglezero-dayuse-after-freexml
Vendors
Google
Products
Chrome
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-125350
Use-after-free in Chrome XML before 157.0.8103.50
8.8—KEVPoC
KEV

From the original article

1 min read at securityweek.com

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek.

SecurityWeek

By Eduard Kovacs · securityweek.com

Read the full article at SecurityWeek

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.