Google Patches Actively Exploited Chrome Flaw CVE-2026-125350

Google has released security updates to patch nine vulnerabilities in its Chrome browser, including a high-severity zero-day flaw that is actively exploited in the wild. Tracked as CVE-2026-125350, the vulnerability is a use-after-free issue in the browser's XML component that could allow arbitrary code execution, data corruption, or program crashes. Users and system administrators should update immediately to protect endpoints. Suspected security incidents can be reported to Cyber999 via MyCERT.

Key Facts

What Is the Nature and Impact of CVE-2026-125350?

CVE-2026-125350 is a high-severity use-after-free vulnerability located within Google Chrome's XML component. The flaw occurs when memory is accessed after being freed, potentially allowing an attacker to trigger data corruption, program crashes, or execute arbitrary code on a vulnerable target system. Google has patched the issue alongside eight other security vulnerabilities.

An anonymous security researcher reported the flaw to Google on 6 November 2026. The vulnerability marks the eighth actively exploited Chrome zero-day addressed by Google in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

Google has addressed eight actively exploited Chrome zero-day vulnerabilities since the beginning of 2026.

Is the Vulnerability Being Actively Exploited?

Yes, Google has confirmed active in-the-wild exploitation of CVE-2026-125350. While the company confirmed that an exploit exists in real-world attacks, it has withheld technical details regarding attack methods and threat actors to prevent wider exploitation while users update their browsers across supported operating systems.

Google stated that access to bug details and links will remain restricted until a majority of users update with the fix. Restrictions will also be retained if the bug exists in a third-party library that other dependent projects have not yet fixed.

Google restricts access to vulnerability details until a majority of users update or dependent third-party libraries receive patches.

What Should You Do?

• Update Google Chrome to version 157.0.8103.50/.51 for Windows and macOS, or version 157.0.8103.50 for Linux.
• Ensure the update is installed by navigating to More > Help > About Google Chrome and selecting Relaunch.
• Apply corresponding patches for other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, as soon as vendor fixes are available.
• Report suspected cyber incidents or compromises to Cyber999 (MyCERT).

Common Questions

Who discovered and reported CVE-2026-125350?

An anonymous security researcher discovered and reported CVE-2026-125350 to Google on 6 November 2026. Google publicly credited the anonymous researcher in its security update announcing patches for the XML component flaw alongside eight other vulnerabilities.

Are other Chromium-based web browsers affected by this issue?

Yes, browsers sharing the Chromium engine, such as Microsoft Edge, Brave, Opera, and Vivaldi, may incorporate the affected XML component. Google notes bug restrictions may remain if third-party libraries depend on the code, and users must apply browser-specific updates once available.

Has Google identified the threat actor exploiting this flaw?

No, Google has not disclosed threat actor attribution or real-world attack mechanics for CVE-2026-125350. The company confirmed an exploit exists in the wild, but intentionally keeps specific technical details restricted until the majority of Chrome users update their installations.

Sources and Methodology

This dispatch was prepared based solely on reporting from The Hacker News published on 10 November 2026. No other documents, vendor advisories, or external databases were reviewed or verified for this summary.