Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Google patches exploited Chrome zero-day CVE-2026-125350, its eighth of 2026

Original title: Chrome zero-day whack-a-mole continues as 2026 tally hits 8

The Register · Securityby Carly Page ()2 min read
Read at theregister.com
Part of a story covered by 7 sourcesGoogle patches exploited Chrome XML use-after-free, eighth 2026 zero-dayMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

The high-severity XML use-after-free is fixed in Chrome 157.0.8103.50 and .51; exploit details remain withheld.

Google patched CVE-2026-125350, a high-severity use-after-free in Chrome’s XML component, and said an exploit exists in the wild. The fix is in Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux. The same release addresses eight other vulnerabilities, including another XML use-after-free, CVE-2026-125346, which Google has not said is exploited. Google did not name attackers or targets and is withholding technical details until more users update.

Unconfirmed: Google has not said who is exploiting CVE-2026-125350, who is targeted, or how the flaw is used.

Key facts
  • The flaw was reported anonymously on November 6.
  • This is Google’s eighth actively exploited Chrome zero-day patched in 2026, matching 2025.
  • CVE-2026-125346 was reported in October by Arni Hardarson of Neonix Security.
  • Users can check for the update under Chrome Settings, About Chrome.
Security assessment · AI, from the articleExploited in the wild

Impact: In-the-wild exploitation of a Chrome XML use-after-free

ProductAffectedFixed in
Google Chrome—157.0.8103.50/.51 for Windows and macOS; 157.0.8103.50 for Linux
What to do
  1. 1.Update Chrome to 157.0.8103.50/.51 on Windows and macOS, or 157.0.8103.50 on Linux.
Analyze CVE-2026-125350 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-125350CVE-2026-125346
Tags
chromezero-dayuse-after-freegooglebrowser
Vendors
Google
Products
Chrome
Organizations
Neonix Security

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-125350
+1 related CVE
CVE-2026-125346
Use-after-free in Chrome XML before 157.0.8103.50
8.8—KEVPoC
KEV

From the original article

2 min read at theregister.com

Another Chrome memory bug gets squashed, but not before attackers got their hands on it

The Register · Security

By Carly Page · theregister.com

Read the full article at The Register · Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.