MeridianMeridian

Google Patches Eighth Actively Exploited Chrome Zero-Day CVE-2026-125350 of 2026

Google released updates addressing nine vulnerabilities in Chrome, including one actively exploited zero-day tracked as CVE-2026-125350. The flaw is a use-after-free issue in the XML component that can lead to data corruption, crashes, or arbitrary code execution. An anonymous researcher reported the bug on November 6, 2026, and Google confirmed in-the-wild exploitation without disclosing attacker details. This marks the eighth actively exploited Chrome zero-day patched by Google since the beginning of 2026. Affected users should immediately update to Chrome version 157.0.8103.50 or later on Windows, macOS, and Linux. Other Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi are also urged to apply equivalent fixes promptly.

The Hacker NewsTranslated from English

Read at source

Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.

The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after it has already been freed. Successful exploitation of these vulnerabilities could allow an attacker to achieve data corruption, program crashes, or arbitrary code execution.

An anonymous security researcher has been credited with discovering and reporting the flaw on November 6, 2026. Google acknowledged it is "aware that an exploit for CVE-2026-125350 exists in the wild," but has not revealed any additional specific information related to how it's being abused in real-world attacks or who is behind them.

"Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the tech giant added. "We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on, but haven't yet fixed."

With the latest development, Google has addressed a total of eight actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

For optimal protection, users are advised to update their Chrome browser to versions 157.0.8103.50/.51 for Windows and Apple macOS, and 157.0.8103.50 for Linux. To ensure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch.

Users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to apply the fixes as and when they become available.

Google ChromeMicrosoft EdgeCVE-2026-125350CVE-2026-2441CVE-2026-3909
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits
Vulns & Exploits

N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits

N-able has taken its N-central Hosted Environments offline across Americas, APAC, and Europe following the public disclosure of more than 30 zero-day vulnerabilities collectively tracked as Able2Shell. Independent researcher Sean Bales published proof-of-concept exploits for flaws affecting N-central Appliance 2026.4.0.31, including credential disclosure, arbitrary file writes, directory traversal, XSS, XXE injection, and remote code execution. The issues enable anonymous credential theft, administrator account creation, and root-level command execution through multiple attack chains such as XXE/NCI trust abuse, support-token theft, and XSS-to-OGNL. N-able stated it has not observed active exploitation in the wild and is preparing a hot fix while advising on-premises customers to shut down servers until remediation is available. Impacted services include both hosted and on-premise deployments of N-central, while Ecoverse services under N-able Login remain operational.

The Hacker NewsNov 10, 2026Translated from English

CISA Adds Four Actively Exploited Flaws in OpenSSH, GPUStack, FreeSwitch and IBM Aspera Faspex to KEV Catalog
Vulns & Exploits

CISA Adds Four Actively Exploited Flaws in OpenSSH, GPUStack, FreeSwitch and IBM Aspera Faspex to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added four high-severity vulnerabilities to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. The flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH on Linux, and IBM Aspera Faspex, with CVSS scores ranging from 8.1 to 9.8. Exploitation of the OpenSSH flaw, tracked as CVE-2026-123158 and nicknamed SSHole, began on November 6, 2026, with at least 22 attempts recorded from 14 unique IP addresses. Post-exploitation activity includes reconnaissance, cloud metadata queries, password hash theft, and deployment of the Python-based TAC Agent command-and-control framework. Federal Civilian Executive Branch agencies have until November 12, 2026 to apply available patches. The remaining three vulnerabilities also show signs of real-world abuse, though public details on attackers and scale remain limited.

The Hacker NewsNov 10, 2026Translated from English

Chrome Update Patches Exploited XML Zero-Day CVE-2026-125350, Eighth This Year
Vulns & Exploits

Chrome Update Patches Exploited XML Zero-Day CVE-2026-125350, Eighth This Year

Google released Chrome 157 updates addressing nine vulnerabilities, one of which is a high-severity zero-day actively exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free issue in the browser’s XML component and was reported anonymously on November 6. No further details on the attacks have been disclosed, and CISA has not yet added the CVE to its Known Exploited Vulnerabilities catalog. This marks the eighth Chrome zero-day exploited in 2026 after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. The update also resolves six additional high-severity issues in WebGL, FileSystem, Compositing, GPU, V8, and XML, plus two medium-severity uninitialized resource bugs in GPU. Patches are available in versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux.

SecurityWeekNov 10, 2026Translated from English