Chrome patches exploited XML use-after-free zero-day CVE-2026-125350
Original title: Google Chrome Patches Eighth Zero-day Vulnerability of the Year (CVE-2026-125350)
The XML use-after-free is Chrome’s eighth zero-day this year; CISA wants users patched before November 24.
Google shipped stable-channel updates fixing nine Chrome flaws, including CVE-2026-125350, a use-after-free in the XML component that is being exploited. Successful exploitation may corrupt data, destabilize the system, or run arbitrary code. CISA added the flaw to its Known Exploited Vulnerabilities catalog. Builds before 157.0.8103.50 are affected.
Unconfirmed: The stated Windows and Mac fixed build, 57.0.8103.50/.51, does not match the 157.0 affected-version string.
- The same release fixes eight other Chrome flaws besides the zero-day.
- Qualys customers can find vulnerable assets with QID 389337.
- CISA set a patch-by date of November 24, 2026.
- The source lists Windows and Mac fixes as 57.0.8103.50/.51.
Impact: Arbitrary code execution, data corruption, or instability
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | before 157.0.8103.50 | 57.0.8103.50/.51 (Windows and Mac); 157.0.8103.50 (Linux) |
- 1.Upgrade Chrome to the stable builds named in the Google release.
- 2.Apply the update before November 24, 2026, per CISA.
- 3.Scan with Qualys QID 389337 to find vulnerable assets.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 group max | — | KEVPoC ×3 | KEV |
From the original article
1 min read at threatprotect.qualys.comGoogle released security updates to address nine vulnerabilities impacting the Chrome browser. One of these vulnerabilities, tracked as CVE-2026-125350, is being exploited in the wild. This is a use-after-free flaw affecting the XML component.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.