cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Google Patches Actively Exploited Chrome XML Use-After-Free Flaw

· Original article ↗

Summary

Google released Chrome updates for nine vulnerabilities, including CVE-2026-125350, an XML use-after-free flaw it says is being exploited in the wild. The company disclosed no attack details or threat actor.

Key points

  • Google says an exploit for CVE-2026-125350 exists in the wild; it did not disclose how the flaw is being abused or who is behind the attacks.
  • The high-severity flaw is a use-after-free bug in Chrome's XML component.
  • Google credited an anonymous researcher with reporting the vulnerability on November 6, 2026.
  • Google released updates addressing nine security vulnerabilities.
  • Users should update Chrome to versions 157.0.8103.50 or .51 on Windows and macOS, and 157.0.8103.50 on Linux.
  • Google also advised users of Chromium-based browsers, including Edge, Brave, Opera, and Vivaldi, to apply fixes when available.

Article Details

Vulnerability Types
  • Use-after-free in the XML component
Severity
High
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-125350Vendor / Product unavailableThe high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.

Vendors

GoogleGoogle on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.

Products

Google ChromeWith the latest development, Google has addressed a total of eight actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281,

Related Articles