Google patches in-the-wild Chrome XML zero-day CVE-2026-125350
Original title: Google Chrome Zero-Day Vulnerability Exploited in the Wild
Stable builds 157.0.8103.50 and .51 close nine flaws; Google has not confirmed code execution or named attackers.
Google published a Stable Channel update on November 9, 2026, fixing nine Chrome vulnerabilities, seven rated high. CVE-2026-125350 is a use-after-free in XML that an anonymous researcher reported on November 6. Google says an exploit exists in the wild but has not named attackers, targets, delivery, or confirmed crash or code execution. Users must install the newer 157 builds; rollout will take days to weeks.
Unconfirmed: Google has not confirmed code execution, attackers, targets, or how the exploit is delivered.
- Patched builds are 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux.
- CVE-2026-125350 is issue 582442907; a separate XML use-after-free, CVE-2026-125346, is not called exploited.
- Other high fixes cover WebGL, FileSystem, Compositing, GPU, and V8; two GPU issues are medium.
- Google may withhold bug details until most users or dependent projects are updated.
Impact: Possible crash or code execution; outcomes not confirmed
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 (Windows and Mac); 157.0.8103.50 (Linux) |
- 1.Install Chrome 157.0.8103.50 or .51 via Help > About Google Chrome and relaunch.
- 2.Administrators should verify those patched builds on managed devices.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 group max | — | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
Google released a Chrome security update that fixes nine vulnerabilities, including a high-severity XML flaw being exploited in the wild. Tracked as CVE-2026-125350, the zero-day makes this release a priority for Windows, macOS, and Linux users. Google published the update on November 9, 2026.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.