Google Issues Emergency Patch for Eighth Chrome Zero-Day Exploited in Attacks This Year

Google has released emergency security updates to address CVE-2026-125350, a high-severity Use-After-Free vulnerability in the XML component of Chrome that is being actively exploited in the wild. This marks the eighth zero-day exploited in attacks since the beginning of 2026. The flaw allows attackers to manipulate memory layout and execute malicious code after the browser fails to clear a pointer to a deleted object. Google has confirmed exploitation but has not disclosed further details about the incidents or threat actors involved. The company has also listed seven previously patched zero-days exploited this year, including multiple issues in the V8 engine and other components. Patches are now rolling out to Stable Desktop users on Windows, macOS, and Linux.

BleepingComputerNovember 10, 2026Translated from English

Read at source

Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory. As Google explained, this flaw stems from a Use-After-Free (UAF) weakness in the XML component of the Google Chrome web browser, which occurs when the browser's XML parser processes data, deletes an object from the computer's memory, but fails to clear the pointer referencing that object.

Attackers can exploit this high-severity memory corruption vulnerability when the browser later tries to use or read that "freed" memory space to manipulate the memory layout and execute malicious code. While Google has found evidence of attackers exploiting this zero-day bug in the wild, it has not shared additional details about these incidents.

"Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed," it noted.

Google has now fixed the zero-day for users in the Stable Desktop channel, with new versions rolling out to Windows, macOS (157.0.8103.50/.51), and Linux users (157.0.8103.50). Although Google says the security update could take days or weeks to reach all Chrome users, it was available immediately when checked for updates today.

Previously Patched Zero-Days in 2026

Since the start of the year, Google has addressed seven other actively exploited zero-day vulnerabilities:

An iterator invalidation bug (CVE-2026-2441) in CSSFontFeatureValuesMap, addressed in mid-February.
Two other Chrome zero-day bugs patched in March: an out-of-bounds write weakness in the Skia 2D graphics library (CVE-2026-3909), and an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).
A use-after-free weakness in Dawn (CVE-2026-5281), the underlying cross-platform implementation of the WebGPU standard, patched in April.
An out-of-bounds read and write vulnerability in Chrome's V8 JavaScript engine (CVE-2026-11645), patched in June.
Out-of-bounds write (CVE-2026-87491) and type confusion (CVE-2026-85046) flaws in the V8 JavaScript engine, fixed in September.

Google fixed eight more zero-days exploited in attacks in 2025, many of them reported by the company's Threat Analysis Group (TAG).

Skia Dawn Google Chrome CVE-2026-125350 V8 JavaScript engine Threat Analysis

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

Attackers Exploit Critical Barracuda ESG Vulnerabilities for Root Access

Barracuda Networks has warned that threat actors are actively exploiting two recently patched vulnerabilities in its Email Security Gateway appliances. The flaws, tracked as CVE-2026-116606 and CVE-2026-111560, allow attackers to modify global configurations and execute operating system commands with root privileges. Exploitation requires access to the administrative user interface, prompting Barracuda to advise restricting Admin UI exposure to trusted internal networks. The company confirmed limited attacks against a small number of customers and urged immediate application of patches such as BNSF-40425. Historical context shows UNC4841 previously targeted similar Barracuda ESG zero-days, including CVE-2023-7102 and CVE-2023-2868, to deploy SeaSpy and Saltwater malware. Mandiant reported that nearly one-third of victims in the 2023 campaign were government agencies. Barracuda recommends enabling automatic patching to mitigate further risk across affected products including Load Balancer ADC and Web Application Firewall.

BleepingComputerNov 10, 2026Translated from English

Vulns & Exploits

SAP Patches Four CVSS 10.0 Flaws in NetWeaver, Web Dispatcher, Gateway and SAML

SAP released its November Security Patch Day fixes addressing four critical vulnerabilities, each rated CVSS 10.0, that require no authentication or user interaction to exploit. Two of the flaws, in the Internet Communication Manager and Web Dispatcher, allow remote code execution via crafted network traffic that corrupts memory. A third issue in the SAML 2.0 service provider permits attackers to impersonate any user, including privileged accounts, on systems using SAML single sign-on. The fourth flaw in SAP Gateway enables external attackers to bypass access controls and impersonate internal application servers. RedRays analysis stresses immediate kernel and Web Dispatcher updates across all instances and provides configuration guidance to reduce exposure until patches are applied.

The Hacker NewsNov 10, 2026Translated from English

Vulns & Exploits

CISA Adds Exploited IBM Aspera Faspex and SignalWire FreeSwitch Vulnerabilities to KEV Catalog

The Cybersecurity and Infrastructure Security Agency warned that threat actors are actively exploiting critical flaws in IBM Aspera Faspex and SignalWire FreeSwitch. CVE-2026-123218 is an authorization bypass in Aspera Faspex that allows authenticated users to obtain full administrative privileges via crafted messages. IBM released version 5.0.19 PL1 to address the issue. CVE-2026-116779 affects SignalWire FreeSwitch and enables code injection leading to sensitive data disclosure, arbitrary call control, and command execution with the privileges of the FreeSwitch process. Both vulnerabilities were added to the Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches within three days. CISA also highlighted ongoing exploitation of a critical GPUStack authentication bypass and the SSHole flaw in OpenSSH.

SecurityWeekNov 10, 2026Translated from English