Google Patches Exploited Chrome XML Use-After-Free Zero-Day
Summary
Google confirmed CVE-2026-125350, a high-severity Chrome XML use-after-free, is exploited in the wild and released fixed versions. The exploit’s delivery, targets, and achieved impact remain undisclosed.
Key points
- Google confirmed on November 9, 2026, that an exploit for CVE-2026-125350 exists in the wild; the vulnerability was reported anonymously on November 6.
- The flaw affects Chrome’s XML component. Google has not disclosed the trigger, delivery method, targets, responsible actors, or impact achieved.
- Fixed versions are Chrome 157.0.8103.50/.51 for Windows and macOS, 157.0.8103.50 for Linux, and Extended Stable 156.0.8078.96 for Windows and macOS.
- Users should update and restart Chrome, then verify the running version; administrators are advised to inventory endpoints and prioritize systems below the fixed releases.
- Defenders can investigate suspicious Chrome-originated processes, crashes followed by execution, downloads, or other unusual endpoint activity, correlating these signals rather than treating them alone as proof of exploitation.
- Google has not published exploit-specific indicators or technical details; the article says SecurityWeek reported that CISA had not added the flaw to its KEV catalog as of November 10.
Article Details
- Vulnerability Types
- Use-after-free memory-safety flaw in Chrome's XML component
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available