// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighCHROMECVSS not assigned

Google Chrome update fixes nine flaws as CVE-2026-125350 is exploited

Google released Chrome updates fixing nine vulnerabilities, including CVE-2026-125350, which is being exploited in the wild. The Hacker News said an anonymous researcher reported the flaw on Nov 6.

· 2 min read
AI-generated image of a security analyst monitoring blurred browser security dashboards in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • CVE-2026-125350 is being exploited in the wild.
  • A remote attacker could exploit the use-after-free vulnerability in XML.
  • Google released updates covering nine security vulnerabilities.

Google has released Chrome updates to patch nine security vulnerabilities, including CVE-2026-125350, which is being exploited in the wild. Google said it is aware that an exploit for the vulnerability exists in the wild.

HKCERT said a remote attacker could exploit the use-after-free vulnerability in XML. Google rates it as high severity.

The Hacker News described the vulnerability as a use-after-free bug in the XML component.

On this page

CVE-2026-125350 affects Chrome’s XML component

The Hacker News said the flaw is a use-after-free bug in the XML component. Heise online said attackers are targeting a use-after-free vulnerability in XML, in which resources are used after they have already been freed.

HKCERT rated the risk level as “Extremely High Risk.” Google rates the vulnerability as “high,” while no CVSS score is listed.

Chrome 157.0.8103.50 and .51 contain the fixes

Google said it fixes the issues in Chrome 157.0.8103.50 for Android and Linux, and in Chrome 157.0.8103.50/.51 for macOS and Windows.

The Hacker News said an anonymous security researcher has been credited with discovering and reporting the flaw on November 6, 2026.

Google is rolling out the updates gradually over the coming days and weeks. It fixes the issues in Chrome 157.0.8103.50 for Android and Linux and Chrome 157.0.8103.50/.51 for macOS and Windows.

CISA said these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. It encourages all organizations to prioritize remediation of vulnerabilities in its KEV Catalog.

What to do now

  1. Apply fixes issued by the vendor: Google Chrome 157.0.8103.50 or later for Linux; Google Chrome 157.0.8103.50/.51 or later for Mac and Windows.
  2. Promptly install the available Chrome update and restart the browser.

FAQ

What happened in the Chrome CVE-2026-125350 vulnerability?

Google released updates for nine vulnerabilities, including CVE-2026-125350, which is being exploited in the wild. The Hacker News said the flaw is a use-after-free vulnerability in Chrome’s XML component.

Is CVE-2026-125350 being exploited?

Yes. HKCERT said it was being exploited in the wild.

Which Chrome versions fix CVE-2026-125350?

Google fixes the issue in Chrome 157.0.8103.50 for Android and Linux, and Chrome 157.0.8103.50/.51 for macOS and Windows.

What can an attacker do with the Chrome XML flaw?

A remote attacker could exploit the use-after-free vulnerability in XML.

Who reported CVE-2026-125350?

The Hacker News said an anonymous security researcher has been credited with discovering and reporting the flaw on November 6, 2026.

Sources

  1. Google Chrome Multiple Vulnerabilities, HKCERTPrimary
  2. CISA Adds Six Known Exploited Vulnerabilities to Catalog, CISAPrimary
  3. Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026, The Hacker News
  4. Chrome update patches actively exploited security flaw, heise online
How we checked this story
ClaimSourceStatus
Google released updates on Monday to patch nine security vulnerabilities, including one under active exploitation in the wild.Google, via The Hacker NewsAttributed
The Hacker News said the vulnerability is a use-after-free bug in Chrome’s XML component.The Hacker NewsAttributed
Google acknowledged that an exploit for CVE-2026-125350 exists in the wild.Google, via The Hacker NewsAttributed
The Hacker News said the vulnerability is assigned CVE-2026-125350 and has no CVSS score listed.The Hacker NewsAttributed
A remote attacker could exploit the use-after-free vulnerability in XML, and it was being exploited in the wild.HKCERTConfirmed
HKCERT rated the risk level as Extremely High Risk.HKCERTConfirmed
CISA says these vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.CISAConfirmed
CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.CISAConfirmed
Google rates the vulnerability as high severity.Google, via heise onlineAttributed
Google fixes the issues in Chrome 157.0.8103.50 for Android and Linux and 157.0.8103.50/.51 for macOS and Windows.Google, via heise onlineAttributed
Google is rolling out the updates gradually over the coming days and weeks.Google, via heise onlineAttributed

Could not verify

  • Whether the vulnerability was exploited against any identified victims is not established
  • Whether Google identified the attackers is not established
  • How many users or systems were affected is not established
  • Whether exploitation led to data theft or code execution is not established
cvegoogle
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok