Google Patches Exploited Chrome XML Zero-Day in Update Fixing Nine Flaws
Summary
Google’s Chrome 157 updates fix nine vulnerabilities, including the high-severity CVE-2026-125350 XML use-after-free, which was exploited in the wild. Google has not shared attack details.
Key points
- Chrome updates patch nine vulnerabilities, including the high-severity CVE-2026-125350, reported as exploited in the wild.
- CVE-2026-125350 is a use-after-free in Chrome’s XML component; an anonymous researcher reported it to Google on November 6.
- Google has not shared details about attacks exploiting the zero-day, and CISA had not added it to its Known Exploited Vulnerabilities catalog.
- The article says this is Chrome’s eighth zero-day exploited this year.
- The updates fix six other high-severity vulnerabilities in WebGL, FileSystem, Compositing, GPU, V8 and XML, plus two medium-severity GPU issues.
- Chrome 157.0.8103.50/.51 is available for Windows and Mac; version 157.0.8103.50 is available for Linux.
Article Details
- Vulnerability Types
- Use-after-free
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-11645Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. CVE-2026-125350Vendor / Product unavailableThe exploited vulnerability, tracked as CVE-2026-125350 and rated high severity, is a use-after-free in the web browser’s XML component.CVE-2026-2441Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. CVE-2026-3909Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. CVE-2026-3910Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. CVE-2026-5281Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. CVE-2026-85046Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. CVE-2026-87491Google · ChromeThis is the eighth Chrome zero-day exploited this year after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.