Science & Tech · Cybersecurity · 52 mins ago
Chrome Update Fixes an Exploited XML Vulnerability
Google released Chrome updates fixing nine security flaws, including a high-severity vulnerability in the browser’s XML component.
The flaw, tracked as CVE-2026-125350, is a use-after-free bug, a type of software error that can create security risks.
Attackers have exploited the flaw, but Google has shared no details about the attacks.
A researcher reported the issue to Google on November 6, and it is Chrome’s eighth exploited zero-day this year.
The updates also fix six other high-severity flaws and two medium-severity issues in Chrome components.
The fixes are included in Chrome 157 for Windows, Mac and Linux, with versions varying by operating system.
Google released Chrome security updates that patch nine vulnerabilities, including a high-severity XML flaw exploited in the wild.
The flaw, tracked as CVE-2026-125350, is a use-after-free vulnerability.
An anonymous researcher reported the issue to Google on November 6, 2026.
Google has not shared details about the attacks or who is behind them.
The update is the eighth Chrome zero-day exploited this year, according to both reports.
- Who
- Google released the update; an anonymous researcher reported the flaw.
- What
- Chrome updates patch nine vulnerabilities, including an exploited use-after-free bug in the XML component.
- When
- Google released the updates on Monday; the researcher reported the flaw on November 6, 2026.
- Where
- In Google Chrome’s XML component.
- Why
- The update addresses a vulnerability being exploited in the wild.
This story does not have two clearly opposing sides.
An anonymous researcher reported the vulnerability to Google.
Google released Chrome updates patching nine vulnerabilities, including the exploited XML flaw.
- CVE
- CVE-2026-125350
- Severity
- High
- Flaw type
- Use-after-free in the XML component
- Patched vulnerabilities
- Nine
- Windows and macOS versions
- 157.0.8103.50/.51
- Linux version
- 157.0.8103.50
3 sources
What people are saying
aware that an exploit for CVE-2026-125350 exists in the wild
Access to bug details and links may be kept restricted until a majority of users are updated with a fix