Threat watch / Vulnerability
Chrome: Google patches an XML zero-day exploited in the wild, the eighth of 2026
On November 9, 2026, Google shipped Chrome 157.0.8103.50/.51 with a fix for CVE-2026-125350, a high-severity use-after-free in the browser's XML component. Google says "an exploit for CVE-2026-125350 exists in the wild" but has shared no details on the attacks. It is the eighth Chrome zero-day exploited this year, according to BleepingComputer and SecurityWeek.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- Google Chrome
- How it happened
- CVE-2026-125350 is a use-after-free in Chrome's XML component: memory is freed but still used, which BleepingComputer describes as a high-severity memory corruption flaw. Google confirms an exploit exists in the wild but has not said how it is delivered or who uses it.[2][3] Checked 10 Nov 2026
- What was stolen
- Not public yet Checked 10 Nov 2026
- Who was impacted
- Not public yet Checked 10 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-125350
Timeline
- A researcher who wants to remain anonymous reports the flaw to Google, according to SecurityWeek. [3]
- Google releases Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out "over the coming days/weeks". Its advisory says it "is aware that an exploit for CVE-2026-125350 exists in the wild". [1][2][4]
- SecurityWeek notes that the update fixes nine flaws in total and that CISA had not yet added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog. [3]
- CISA adds CVE-2026-125350 to its Known Exploited Vulnerabilities catalog, according to Cyber Security News, which says the entry lists ransomware use as unknown. [5]