Google has patched a Chrome zero-day that is already being exploited in the wild. The vulnerability, CVE-2026-125350, affects Chrome’s XML component and requires organisations to update affected browsers promptly.
Google disclosed the issue on 9 November 2026 as part of a Stable channel update containing nine security fixes. However, the company has not identified the attackers, victims or scale of exploitation.
Chrome Zero-Day CVE-2026-125350 Explained
CVE-2026-125350 is a high-severity use-after-free vulnerability in the XML component of Google Chrome. An anonymous security researcher reported the flaw to Google on 6 November 2026, only three days before the security update and public acknowledgement of exploitation.
A use-after-free vulnerability occurs when software continues to access a section of memory after it has been released. If an attacker can control what replaces the freed memory, they may be able to corrupt the application’s memory or influence how it behaves.
In a browser, crafted web content could potentially trigger this type of memory safety problem inside a renderer process. Possible consequences include a browser crash or code execution within that process, depending on the vulnerability and available exploit techniques.
Some reports have described this Chrome zero-day as a remote code execution vulnerability. Google’s advisory does not classify it as remote code execution, disclose its confirmed impact or state that attackers can escape Chrome’s security sandbox. SANS Internet Storm Center also noted on 10 November 2026 that a sandbox escape has not been confirmed.
This distinction is important because browser exploitation often involves more than one vulnerability. An attacker may use one flaw to gain code execution inside a restricted renderer and another to break out of the sandbox or increase privileges. No such exploit chain has been documented publicly for CVE-2026-125350.
Affected Chrome Versions and Available Fixes
The Chrome zero-day affects desktop installations that have not yet received the latest Stable channel release. Google is rolling out the update over a period of days and weeks, meaning some browsers may not install it immediately without a manual check.
The fixed Chrome Stable versions are:
- Windows: Chrome 157.0.8103.50 or 157.0.8103.51
- macOS: Chrome 157.0.8103.50 or 157.0.8103.51
- Linux: Chrome 157.0.8103.50
- Android: Chrome 157 contains the same security fixes as the corresponding desktop release, unless otherwise noted by Google
For organisations using Chrome Extended Stable, Google has released version 156.0.8078.96 for Windows and macOS. Administrators should verify the installed channel before checking whether an endpoint has reached the required version.
Users can initiate the update by opening Chrome, selecting Help and then About Google Chrome. The browser will check for an available release, but it must be relaunched before the Chrome zero-day fix is fully applied. An update downloaded in the background does not protect the active browser session until that restart occurs.
Exploitation Status and Disclosure Timeline
Google has explicitly stated that it is aware of an exploit for CVE-2026-125350 existing in the wild. This confirms active exploitation, but the available information does not establish whether the activity is widespread, part of targeted campaigns or connected to a known threat group.
The confirmed timeline is short:
- 6 November 2026: An anonymous researcher reported CVE-2026-125350 to Google.
- 9 November 2026: Google published the Stable channel update, identified the vulnerability as a use-after-free issue in XML and acknowledged in-the-wild exploitation.
- 9 to 10 November 2026: Security outlets and community sources highlighted the update, while SANS noted that Google’s advisory does not confirm a sandbox escape.
Google has not published indicators of compromise, malicious domains, file hashes or other evidence that defenders could use to identify attacks. It has also not disclosed how victims encounter the exploit or the specific web content required to trigger it.
Technical details in the Chromium issue tracker remain restricted. Google commonly limits access to vulnerability information until a majority of users have received the update, reducing the opportunity for other attackers to recreate an exploit while many systems remain exposed.
As a result, defenders cannot currently rely on public signatures specific to this Chrome zero-day. Updating the browser is the main confirmed way to address the vulnerability while further technical information remains unavailable.
Eight Other Vulnerabilities Fixed in Chrome 157
The same release fixes eight additional vulnerabilities, bringing the total number of security fixes to nine. Seven of the nine issues are rated High, including CVE-2026-125350, while two GPU vulnerabilities are rated Medium.
The additional fixes cover several security-sensitive browser components:
- CVE-2026-125346: Use-after-free vulnerability in XML.
- CVE-2026-125344: Type confusion vulnerability in the V8 JavaScript engine.
- CVE-2026-125348: Out-of-bounds write in the GPU component.
- CVE-2026-125347: Incorrect authorisation in FileSystem.
- CVE-2026-125343: Buffer overflow in Compositing.
- CVE-2026-125345: Uninitialised resource vulnerability in WebGL.
- CVE-2026-125349: Medium-severity uninitialised resource vulnerability in the GPU component.
- CVE-2026-125342: Medium-severity uninitialised resource vulnerability in the GPU component.
CVE-2026-125346 is particularly notable because it is a second use-after-free flaw in the XML component. It was reported by Arni Hardarson of Neonix Security, although Google has not said that this separate vulnerability is being exploited.
The other fixes address memory corruption, authorisation and resource initialisation problems across V8, WebGL, FileSystem, Compositing and GPU processing. Google’s acknowledgement of active exploitation applies specifically to CVE-2026-125350.
Why This Chrome Zero-Day Matters
Chrome is routinely exposed to content from websites, advertisements, email links and online services. A browser flaw that can be reached through crafted content creates a practical route for attackers because users may only need to visit a malicious or compromised page.
The limited disclosure also makes exposure harder to assess. Without indicators of compromise or information about targeted victims, organisations cannot assume they are unaffected simply because no suspicious activity has been detected.
Actions for Organisations Using Chrome
Organisations should prioritise deployment of the fixed versions rather than waiting for the gradual rollout to complete. Managed environments should confirm both that the update was installed and that Chrome was relaunched successfully.
- Deploy Chrome 157.0.8103.50 or later across Windows, macOS and Linux endpoints.
- Deploy Extended Stable 156.0.8078.96 where that enterprise channel is used.
- Check management consoles for devices that downloaded the update but have not restarted Chrome.
- Verify Android 157 deployment on managed mobile devices where applicable.
- Monitor updates for other Chromium-based browsers used within the organisation.
- Review Google’s Chrome Releases page for further details or indicators if restrictions are lifted.
Because exploitation is confirmed and no specific detection guidance is available, version verification is the most reliable immediate control. Prompt deployment closes the known vulnerability while Google continues to restrict the technical details of the Chrome zero-day.
Originally reported by cybersecuritynews.com.
