Google fixes exploited Chrome zero-day CVE-2026-125350
Original title: Google fixes the eighth actively exploited Chrome zero-day of 2026
The use-after-free in XML is the eighth exploited Chrome zero-day of 2026; fixed builds are 157.0.8103.50 and .51.
Google patched nine Chrome flaws, including CVE-2026-125350, a use-after-free in XML reported anonymously on November 6, 2026. Google says an exploit exists in the wild but has not described the attacks or who is behind them. Fixed releases are Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out over coming days and weeks. Bug details stay restricted until most users update.
Unconfirmed: The lede calls CVE-2026-125350 a V8 flaw, while the body says it is a use-after-free in XML.
- Google says it is aware that an exploit for CVE-2026-125350 exists in the wild.
- The flaw was reported by an anonymous source on November 6, 2026.
- Windows and Mac fixes are 157.0.8103.50 and 157.0.8103.51; Linux is 157.0.8103.50.
- The article's opening also calls the same CVE a V8 issue.
- Google patched nine Chrome flaws in this release.
Impact: In-the-wild Chrome exploit; code execution possible
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 for Windows and Mac; 157.0.8103.50 for Linux |
- 1.Update Chrome to 157.0.8103.50/.51 on Windows and Mac, or 157.0.8103.50 on Linux.
- CVEs
- CVE-2026-125350
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.