Google Patches Exploited Chrome XML Zero-Day CVE-2026-125350

Summary

Google patched CVE-2026-125350, an exploited Chrome use-after-free in XML handling. The article outlines fixed versions, a possible libxslt-related cause that Google has not confirmed, and steps to update Chrome and other Chromium browsers.

Key points

Google says CVE-2026-125350 is being exploited in the wild; it has not named attackers, targets, or the scale of activity.
The vulnerability is a high-severity use-after-free in XML handling. A public Chromium fix points to Chrome’s bundled libxslt, but Google has not confirmed that technical interpretation.
Fixed Chrome versions include Stable 157.0.8103.50 for Windows, macOS, Linux, and Android, and Extended Stable 156.0.8078.96 for Windows and macOS; a relaunch is required to activate the fix.
The November 9 update includes nine security fixes. Google has not said CVE-2026-125346, another XML use-after-free in the update, is exploited.
Vivaldi had shipped updates by November 10; the article says Microsoft, Brave, and Opera had not publicly tied a release to this CVE at the time of writing.
The article recommends checking browser versions across Chromium-based browsers, using fleet inventory, and monitoring for unusual browser activity; it notes Google has published no indicators.
CISA added the CVE to its Known Exploited Vulnerabilities catalog and set a November 24 remediation deadline for covered U.S. federal civilian agencies.

Article Details

Vulnerability Types: Use-after-free in XML handling
Severity: High (CVSS 8.8)
Affected Versions: Google Chrome versions below 157.0.8103.50 (Stable)
Google Chrome versions below 156.0.8078.96 (Extended Stable)
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Some analysts suggest disabling XSLT processing with Chrome’s XSLTEnabled enterprise policy until updates are installed; this is not Google guidance and should be tested against internal applications.