Google patches exploited Chrome XML use-after-free CVE-2026-125350
Original title: Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Chrome 157.0.8103.50 and .51 fix the XML bug; Google says an exploit is already in the wild.
Google released Chrome updates fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free in the XML component. The company says an exploit exists in the wild but has not described the attacks or who is behind them. An anonymous researcher reported the flaw on November 6, 2026. It is the eighth actively exploited Chrome zero-day Google has addressed in 2026.
Unconfirmed: Google has not said how the exploit is used or who is behind the attacks.
- Fixed builds are 157.0.8103.50/.51 on Windows and macOS and 157.0.8103.50 on Linux.
- Successful exploitation may corrupt data, crash the browser, or run arbitrary code.
- Bug details stay restricted until most users receive the fix.
- Edge, Brave, Opera, and Vivaldi should apply fixes when their vendors release them.
Impact: data corruption, crashes, or arbitrary code execution
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 (Windows, macOS); 157.0.8103.50 (Linux) |
- 1.Update Chrome to 157.0.8103.50/.51 on Windows and macOS, or 157.0.8103.50 on Linux.
- 2.Apply fixes for Chromium-based browsers when those vendors release them.
- CVEs
- CVE-2026-125350
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |
From the original article
1 min read at thehackernews.com
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.