Chrome Update Patches Exploited XML Zero-Day CVE-2026-125350, Eighth This Year
Google released Chrome 157 updates addressing nine vulnerabilities, one of which is a high-severity zero-day actively exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free issue in the browser’s XML component and was reported anonymously on November 6. No further details on the attacks have been disclosed, and CISA has not yet added the CVE to its Known Exploited Vulnerabilities catalog. This marks the eighth Chrome zero-day exploited in 2026 after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. The update also resolves six additional high-severity issues in WebGL, FileSystem, Compositing, GPU, V8, and XML, plus two medium-severity uninitialized resource bugs in GPU. Patches are available in versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux.
SecurityWeekNov 10, 2026Translated from English