Google patches exploited Chrome XML use-after-free, eighth 2026 zero-day
First merged summary.
Google has patched CVE-2026-125350 in Chrome 157, saying an exploit is in the wild; CISA listing status is disputed.
Google released Chrome Stable updates fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free in the XML component that it says is already exploited. An anonymous researcher reported the flaw on November 6. Fixed builds are 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux; Malwarebytes also lists that Linux build for Android. Google has not described attackers, targets, or the exploit and is withholding technical details until most users update. CISA’s catalog entry says the bug was added to KEV with a November 24 federal deadline, while SecurityWeek reports CISA has not listed it. Security Affairs’ opening also calls the same CVE a V8 issue; other outlets describe it as an XML flaw.
- Fixed builds: 157.0.8103.50/.51 on Windows and macOS; 157.0.8103.50 on Linux.
- Malwarebytes says the Stable update shipped November 9 and covers Android.
- Anonymous report on November 6; Google confirms exploitation without attack details.
- Eighth exploited Chrome zero-day Google has patched in 2026.
- CISA lists a November 24 BOD 26-04 deadline; ransomware use unknown.
- HKCERT rated the update’s overall risk Extremely High, according to Malwarebytes.
Timeline
dated events in the reporting · oldest first- Nov 6, 2026Anonymous researcher reported the XML use-after-free. · The Hacker News
- Nov 9, 2026Google updated Chrome Stable with nine security fixes. · Malwarebytes Labs
- Nov 10, 2026CISA catalog lists the CVE with a November 24 deadline. · CISA
- Nov 10, 2026SecurityWeek says CISA has not added the CVE to KEV. · SecurityWeek
What each outlet adds
beyond the shared facts- CISAKEV entry, sandbox code execution, and a November 24 federal deadline.
- SecurityWeekSays CISA has not cataloged the CVE; names other bug areas.
- The Hacker NewsLists Edge, Brave, Opera, and Vivaldi as needing vendor fixes.
- Malwarebytes LabsNovember 9 release date, Android build, and HKCERT Extremely High rating.
- The RegisterSays the 2026 exploited Chrome zero-day tally matches 2025.
- Organizations
- CISAHKCERTNeonix Security
Coverage
oldest first · one row per article · UTC- · 1d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA adds Chromium XML use-after-free CVE-2026-125350 to KEV
A crafted webpage can run code inside the Chromium sandbox; federal mitigation deadline is November 24.
- · 21h ago
SecurityWeek
Chrome 157 patches exploited XML use-after-free, CVE-2026-125350
Windows and Mac builds 157.0.8103.50 and .51, and Linux 157.0.8103.50, include the fix.
- · 21h ago
The Hacker News
Google patches exploited Chrome XML use-after-free CVE-2026-125350
Chrome 157.0.8103.50 and .51 fix the XML bug; Google says an exploit is already in the wild.
- · 19h ago
BleepingComputer
Google patches exploited Chrome zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 fix a use-after-free in Chrome's XML parser; attack details stay restricted.
- · 18h ago
Security Affairs
Google fixes exploited Chrome zero-day CVE-2026-125350
The use-after-free in XML is the eighth exploited Chrome zero-day of 2026; fixed builds are 157.0.8103.50 and .51.
- · 14h ago
Malwarebytes Labs
Google patches exploited Chrome XML use-after-free, CVE-2026-125350
Stable updates reach 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux and Android.
- · 14h ago
The Register · Security
Google patches exploited Chrome zero-day CVE-2026-125350, its eighth of 2026
The high-severity XML use-after-free is fixed in Chrome 157.0.8103.50 and .51; exploit details remain withheld.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-125350+1 related CVE | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |