Chrome Zero-Day CVE-2026-125350: Google Patches an Exploited XML Flaw in Chrome 157
Chrome zero-day CVE-2026-125350, a use-after-free in XML handling, is exploited in the wild. Google fixed it in Chrome 157.0.8103.50/.51 on 9 November.
Google has patched a Chrome flaw that attackers are already exploiting. In its 9 November stable channel update, Google says it is aware that "an exploit for CVE-2026-125350 exists in the wild". The bug is a use-after-free in Chrome's XML component, rated High. BleepingComputer counts it as the eighth Chrome zero-day exploited in attacks this year. Its list shows four of the seven earlier ones in V8, Chrome's JavaScript engine, the most recent of them CVE-2026-87491 in September.
What is known about the attacks
Almost nothing. An anonymous researcher reported the flaw to Google on 6 November, three days before the fix shipped. Google hasn't said who is using the exploit or against whom, and its release note says bug details may stay restricted until a majority of users are updated. CISA has yet to add CVE-2026-125350 to its Known Exploited Vulnerabilities catalogue.
The same release fixes nine security flaws in total. One of the other eight is a second use-after-free in XML, reported on 12 October by Neonix Security, which Google does not list as exploited.
Microsoft Edge
Microsoft says it is "actively working on releasing a security fix" for Edge. Its newest stable build, 157.0.4341.42 from 5 November, predates Google's patch.
Fixed versions
Update Chrome to 157.0.8103.50 or .51 on Windows and Mac and 157.0.8103.50 on Linux. Google says the rollout will take "the coming days/weeks", so check under Settings, About Chrome and relaunch. Chrome for Android is fixed in 157.0.8103.50. Organisations on the Extended Stable channel should move to 156.0.8078.96, which carries the same fix.
More news
Thai Airways Amadeus Data Breach: 60,529 Passenger Booking Records Accessed, Card Data Not Affected
Thai Airways Amadeus data breach: about 60,529 passenger booking records were accessed through the reservation provider Amadeus, and 376 may include passport numbers. Card data wasn't hit.
SPH Media Data Breach: Attacks on Five Systems Expose About 9% of the Customer Database
SPH Media data breach: attacks on five systems between 4 and 8 November exposed about 9% of the Singapore publisher's customer database, mostly email addresses. No card data was taken.
Data Breach Notices From 10 Philippine Agencies, BIR and SEC Among Them, Reach the Privacy Commission
Data breach notifications from 10 Philippine government agencies, the BIR and SEC among them, have reached the National Privacy Commission, which is now reviewing each case.