cyber.hendryadrian.com
Vulnerability & Exploit · malwarebytes.com

Google Patches Actively Exploited Chrome Zero-Day CVE-2026-125350

· Original article ↗

Summary

Google’s Chrome update for desktop and Android includes a fix for CVE-2026-125350, a high-severity use-after-free flaw in the XML component that Google says is exploited in the wild. Attackers, targets, and delivery method are unknown.

Key points

  • Google released Chrome Stable updates for Windows, Mac, and Linux on November 9, including nine security fixes.
  • The update fixes CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component.
  • Google says it is aware of an exploit for the vulnerability in the wild but has not identified attackers, targets, delivery method, or the exploit’s capabilities.
  • Desktop versions are 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux.
  • Google also released Chrome 157.0.8103.50 for Android; users can check Google Play for the update.
  • Users can update through Chrome’s About Google Chrome page and relaunch the browser to apply the update.

Article Details

Vulnerability Types
  • Use-after-free
Severity
High
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-125350Vendor / Product unavailableabout a vulnerability by an unnamed third party on November 6. The vulnerability is tracked as CVE-2026-125350 and rated as a high-severity use-after-free vulnerability in Chrome’s XML component.

Vendors

GoogleOn November 9, Google issued a security update to Chrome’s Stable channel for Windows, Mac, and Linux. The update is rolling out over the coming days and weeks.

Products

Google ChromeOn November 9, Google issued a security update to Chrome’s Stable channel for Windows, Mac, and Linux. The update is rolling out over the coming days and weeks.

Related Articles