Google patches exploited Chrome XML use-after-free, CVE-2026-125350
Original title: Update Chrome now to fix a flaw attackers are exploiting
Stable updates reach 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux and Android.
On November 9, Google updated Chrome Stable with nine security fixes, including CVE-2026-125350, a high-severity use-after-free in the XML component. An unnamed third party reported it on November 6. Google says an exploit exists in the wild but has not named attackers, targets, delivery, or what the exploit can do. HKCERT rated the update’s overall risk Extremely High.
Unconfirmed: Google has not identified attackers, targets, delivery, or what the in-the-wild exploit can do.
- Windows and Mac fixed builds are 157.0.8103.50 and 157.0.8103.51.
- Linux and Android fixed builds are 157.0.8103.50.
- HKCERT said some fixed flaws could allow denial of service, bypass, or remote code execution.
- Users can update from About Google Chrome, or check Google Play on Android.
Impact: In-the-wild exploit of a Chrome XML use-after-free
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 (Windows, Mac); 157.0.8103.50 (Linux, Android) |
- 1.Update Chrome Stable to 157.0.8103.50 or .51 and relaunch the browser.
- 2.On Android, install Chrome 157.0.8103.50 from Google Play.
- CVEs
- CVE-2026-125350
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |
From the original article
2 min read at malwarebytes.com
Google has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.