Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

Chrome before 157.0.8103.50 exploited in the wild, CISA says

Original title: Google security advisory (AV26-1140) - Update 1

Canadian Centre for Cyber Security ()1 min read1
Read at cyber.gc.ca
Part of a story covered by 11 sourcesGoogle patches exploited Chrome XML zero-day CVE-2026-125350Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Google says CVE-2026-125350 is exploited; CISA added it to KEV on November 10, and desktop Stable Channel builds need the listed updates.

Canada’s Cyber Centre reported that, as of November 9, 2026, Stable Channel Chrome for Desktop before 157.0.8103.50/.51 on Windows and Mac, and before 157.0.8103.50 on Linux, is affected. Google indicates CVE-2026-125350 is exploited in the wild. On November 10, CISA added the CVE to its Known Exploited Vulnerabilities catalog. Users and administrators are urged to apply available updates.

Key facts
  • Fixed Windows and Mac builds are 157.0.8103.50 and 157.0.8103.50/.51 as stated.
  • The Linux fixed build named is 157.0.8103.50.
  • The Canadian notice is AV26-1140, dated November 10, 2026, Update 1.
  • The advisory does not describe what the Chrome flaw allows.
Security assessment · AI, from the articleExploited in the wild
ProductAffectedFixed in
Google Stable Channel Chrome for Desktopprior to 157.0.8103.50/.51 (Windows/Mac) and 157.0.8103.50 (Linux)157.0.8103.50/.51 (Windows/Mac), 157.0.8103.50 (Linux)
What to do
  1. 1.Update Stable Channel Chrome for Desktop to the fixed builds Google lists.
  2. 2.Review the Google Chrome security advisory and the CISA KEV entry for CVE-2026-125350.
Analyze CVE-2026-125350 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-125350
Tags
chromegooglekevbrowser
Vendors
Google
Products
Chrome
Organizations
CISACanadian Centre for Cyber Security

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-125350
Use-after-free in Chrome XML before 157.0.8103.50
8.8<1%KEVPoC ×3
KEV

From the original article

1 min read at cyber.gc.ca

Serial number: AV26-1140 Date: November 10, 2026 As of November 9, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 157. 0. 8103.

Canadian Centre for Cyber Security

cyber.gc.ca

Read the full article at Canadian Centre for Cyber Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.