Google fixes exploited Chrome XML use-after-free zero-day CVE-2026-125350
Original title: Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely
Stable builds 157.0.8103.50/.51 close the high-severity bug; Google is withholding details until most users update.
Google patched CVE-2026-125350, a high-severity use-after-free in Chrome’s XML component that it says attackers are already exploiting for remote code execution. Stable updates are 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux; Extended Stable receives 156.0.8078.96. An anonymous researcher reported the bug on November 6, 2026. The same release fixes eight other flaws. Google has not named the attackers or how many people were targeted.
Unconfirmed: Google has not said who is using the exploit or how many people were targeted.
- The report arrived November 6, 2026, three days before the patch shipped.
- A second XML use-after-free, CVE-2026-125346, is not described as exploited.
- Other High fixes include V8 type confusion and a GPU out-of-bounds write.
- The downloaded fix applies only after Chrome is restarted.
- Chromium-based browsers may need separate vendor patches for shared engine code.
Impact: remote code execution in the browser
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 (Windows, Mac); 157.0.8103.50 (Linux); Extended Stable 156.0.8078.96 |
- 1.Restart Chrome after updating to the fixed Stable or Extended Stable build.
- 2.Update Linux Chrome through the package manager.
- 3.Watch for vendor patches if you use a Chromium-based browser.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 group max | — | KEVPoC | KEV |
From the original article
3 min read at cybersecuritynews.com
Google has fixed a Chrome zero-day that attackers are already using. The flaw is tracked as CVE-2026-125350, and it lets a remote attacker run malicious code in the browser. Google’s Stable channel update moves Chrome to version 157.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.