Google patches Chrome zero-day CVE-2026-125350, an exploited XML use-after-free and the eighth of 2026, in 157.0.8103.50/.51

Linha do tempo

1. securityonline.info ↗ · pub. 10/11/2026 21:45 · coletado 10/11 23:00

   CISA Adds Six Exploited Flaws in Outlook, Chrome, Barracuda, Cisco and Openwave to KEV Catalog

   ler a análise desta fonte ocultar

   CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, 2026. The CISA KEV additions span Microsoft Outlook, Google Chrome, Barracuda appliances, Cisco BroadWorks and Openwave Webtop. Federal agencies must patch the two Barracuda flaws by November 13 and the other four by November 24.

   Attackers are exploiting six flaws, including a Chrome zero-day and a Barracuda ESG root RCE chain. The Barracuda bugs carry an unusually short three-day deadline. Every organization running these products should patch now, not only federal agencies.

2. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

   Google Chrome zero-day CVE-2026-125350 exploited in the wild: XML use-after-free fixed in 157.0.8103.50

   ler a análise desta fonte ocultar

   Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on 9 November 2026. The update fixes CVE-2026-125350, a use-after-free in the Chrome XML component, which Google says has an exploit in the wild. The CERT-FR advisory (cert.cyber.gouv.fr) lists sixteen CVEs for this update, but describes them only as unspecified security issues. Google's Chrome Releases page (chromereleases.googleblog.com), which was opened for this report, confirms the fixed Stable builds and says the rollout will take days to weeks, but its security section was still pending when it was read, so the exploitation statement rests on the CERT-FR advisory and on coverage that was not checked against Google's own text. Urgency is critical because the flaw is under active exploitation and the update reaches a widely used browser.

   Technical Details

   • CVE-2026-125350 is a use-after-free in the Chrome XML component, rated High by Google according to a search result from rescana.com; no CVSS score was found in the sources read.
   • The report was filed on 6 November 2026 by an anonymous researcher (windowsforum.com).
   • The sources read do not state the attack prerequisites, the attack path or the attackers; Google has withheld further technical details until more users have updated (techbooky.com).
   • The release contains nine security fixes according to windowsforum.com. The CERT-FR advisory lists sixteen CVEs, from CVE-2026-121068 to CVE-2026-125350, including CVE-2026-125346, a use-after-free in the same XML component.

   Remediation

   • Update Chrome Stable on Windows and Mac to 157.0.8103.50 or 157.0.8103.51, and Linux to 157.0.8103.50, then restart the browser (chromereleases.googleblog.com).
   • Update Chrome Extended Stable on Windows and Mac to 156.0.8078.96, as listed in the CERT-FR advisory.
   • Enterprise administrators should confirm that the update policy allows the new build and that version reporting shows 157.0.8103.50 or later on every endpoint (blog.ostorlab.co).
3. malwarebytes.com ↗ · pub. 10/11/2026 10:23 · coletado 10/11 12:01

   Google fixes Chrome zero-day CVE-2026-125350, an XML use-after-free exploited in the wild

   HKCERT published a bulletin dated November 10, 2026 that rates the Chrome update Extremely High and states that CVE-2026-125350 is being exploited in the wild (hkcert.org). The article also reports that Chrome 157.0.8103.50 for Android shipped on November 9 with the same fixes as desktop, which the existing report did not record.

   ler a análise desta fonte ocultar

   HKCERT published a bulletin dated November 10, 2026 that rates the Chrome update Extremely High and states that CVE-2026-125350 is being exploited in the wild (hkcert.org). The article also reports that Chrome 157.0.8103.50 for Android shipped on November 9 with the same fixes as desktop, which the existing report did not record.

   Google issued a Stable channel update on November 9 for Google Chrome on Windows, Mac and Linux, moving desktop builds to 157.0.8103.50/.51 (Windows and Mac) and 157.0.8103.50 (Linux), with nine security fixes. One of them is CVE-2026-125350, a high-severity use-after-free in Chrome's XML component, and Google says an exploit for it exists in the wild. Google was notified by an unnamed third party on November 6 and has not named the attackers, the targets, the delivery method or what the exploit can do. Hong Kong's HKCERT rates the overall risk as Extremely High and states that CVE-2026-125350 is being exploited, with a remote attacker able to use this XML flaw (hkcert.org). Criticity is critical because exploitation is confirmed in a browser component most users run, although the delivery vector is unknown. Because the rollout runs over days and weeks, defenders should check the installed version manually.

   Remediation

   • Update Chrome to 157.0.8103.50/.51 on Windows and Mac, or 157.0.8103.50 on Linux, then click Relaunch when prompted.
   • Android users should install Chrome 157.0.8103.50 from Google Play, which carries the same security fixes as the desktop release unless noted.
4. theregister.com ↗ · pub. 10/11/2026 10:28 · coletado 10/11 12:00

   Google patches eighth Chrome zero-day of 2026: CVE-2026-125350 use-after-free in XML exploited in the wild

   This article adds three points to the existing case. It presents the eighth zero-day as matching the full 2025 total. At retrieval the bug was not in the CISA catalog, which the earlier report did not record (rescana.com). It also corrects the earlier report on the update path: the article describes Settings, then About Chrome, not the More > Help path the earlier report attributed to the article.

   ler a análise desta fonte ocultar

   This article adds three points to the existing case. It presents the eighth zero-day as matching the full 2025 total. At retrieval the bug was not in the CISA catalog, which the earlier report did not record (rescana.com). It also corrects the earlier report on the update path: the article describes Settings, then About Chrome, not the More > Help path the earlier report attributed to the article.

   Google has patched CVE-2026-125350, a high-severity use-after-free in the XML component of Google Chrome that the company says is being exploited in the wild. The bug was reported anonymously on November 6 and is fixed in Chrome 157.0.8103.50/.51 for Windows and macOS and in 157.0.8103.50 for Linux. Google has not said who is behind the attacks or which targets are involved, and it is holding back technical details until most users have updated. The article counts this as the eighth Chrome zero-day exploited in 2026, which already equals the full 2025 total. The same release fixes a second XML use-after-free, CVE-2026-125346, which the article does not report as exploited, along with several other high-severity flaws. Criticity is critical because exploitation is confirmed in a browser that most users run, even though the vendor's rating is High and the article gives no CVSS score.

   Technical Details

   • CVE-2026-125350 is a use-after-free in the XML component. The article says it was reported anonymously on November 6 and that Google has not disclosed how the flaw is being exploited.
   • The article gives no CVSS score. Google rates the flaw High, and at retrieval it was not listed in the CISA catalog (rescana.com).
   • CVE-2026-125346 is a second XML use-after-free, reported in October by Arni Hardarson of Neonix Security. The article says Google has not indicated that it is exploited.
   • The release also fixes eight other vulnerabilities, including high-severity flaws in WebGL, FileSystem, GPU, Compositing and the V8 JavaScript engine.

   Remediation

   • Check the installed version through Settings, then About Chrome. The article says the update will roll out over the coming days and weeks, so a manual check is worth doing now.
   • Google is keeping further technical details restricted until enough users have the fix.
5. securityaffairs.com ↗ · pub. 10/11/2026 07:05 · coletado 10/11 09:00

   Google fixes eighth exploited Chrome zero-day of 2026: CVE-2026-125350 use-after-free in XML

   The article places CVE-2026-125350 as the eighth Chrome zero-day exploited in the wild in 2026 and lists the seven earlier ones, each scored CVSS 8.8, which the existing case did not record (securityaffairs.com).

   ler a análise desta fonte ocultar

   The article places CVE-2026-125350 as the eighth Chrome zero-day exploited in the wild in 2026 and lists the seven earlier ones, each scored CVSS 8.8, which the existing case did not record (securityaffairs.com).

   Google has patched nine Chrome flaws, and one of them, CVE-2026-125350, is a use-after-free in the XML component that the company says is exploited in the wild. The bulletin acknowledges that an exploit is circulating but gives no detail on how attackers use it or who they are. The bug was reported by an anonymous party on November 6, 2026, and the article counts it as the eighth Chrome zero-day exploited in 2026 (securityaffairs.com). The fixed builds are Chrome 157.0.8103.50/.51 for Windows and Mac and Chrome 157.0.8103.50 for Linux (securityaffairs.com), and Google's Chrome Releases page lists a Stable Channel Update dated November 9, 2026 (chromereleases.googleblog.com). The article gives no CVSS score for CVE-2026-125350, and the pages consulted did not show one, so the critical rating rests on confirmed exploitation and on browser memory bugs of this kind usually being reached through a web page. Defenders should treat any desktop Chrome without the new build as exposed until every machine reports the fixed version.

6. bleepingcomputer.com ↗ · pub. 10/11/2026 05:51 · coletado 10/11 07:00

   Google patches eighth Chrome zero-day exploited in attacks this year

   ler a análise desta fonte ocultar

   Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.

   "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.

7. gbhackers.com ↗ · pub. 10/11/2026 02:26 · coletado 10/11 04:00

   Google patches Chrome zero-day CVE-2026-125350, an exploited XML use-after-free, in a nine-fix update

   This article adds the reporter and date for each of the nine fixes, including Arni Hardarson of Neonix Security as the reporter of CVE-2026-125346 on October 12, and the issue numbers and report dates for the internal and third-party findings. It also confirms that The Hacker News lists no CVSS score for CVE-2026-125350, and that Google will keep bug details restricted until most users are updated. Google's Chrome Releases post now confirms the Stable build numbers, which were not previously confirmed from Google's own page.

   ler a análise desta fonte ocultar

   This article adds the reporter and date for each of the nine fixes, including Arni Hardarson of Neonix Security as the reporter of CVE-2026-125346 on October 12, and the issue numbers and report dates for the internal and third-party findings. It also confirms that The Hacker News lists no CVSS score for CVE-2026-125350, and that Google will keep bug details restricted until most users are updated. Google's Chrome Releases post now confirms the Stable build numbers, which were not previously confirmed from Google's own page.

   Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on November 9, 2026, fixing nine security bugs. The headline flaw, CVE-2026-125350, is a use-after-free in the XML component that Google says has an exploit in the wild, but Google has not named the attackers, targets, delivery methods or exploit capabilities. The anonymous researcher who reported it did so on November 6, 2026 (thehackernews.com). Seven of the nine fixes are rated high. The article names no authentication step or non-default setting for the zero-day, and the usual delivery route for this bug class in browsers is a booby-trapped web page (cybersecuritynews.com). Criticity is critical because the flaw is exploited in the wild and can be reached through a web page, while the main limits are the unknown attackers and exploit capabilities and Google's decision to keep bug details restricted until most users are patched.

   Technical Details

   • CVE-2026-125350 is a use-after-free in the XML component, tracked as issue 582442907 and reported by an anonymous researcher on November 6, 2026. Google says an exploit exists in the wild but has not described how it is used. Such bugs can cause data corruption, crashes or arbitrary code execution, and Google has not confirmed which of these outcomes applies here (thehackernews.com).
   • CVE-2026-125346 is a second XML use-after-free (issue 572578603), reported on October 12, 2026 by Arni Hardarson of Neonix Security. Google has not identified it as exploited, and its reward is undetermined.
   • Seven fixes are rated high: CVE-2026-125350, CVE-2026-125346, CVE-2026-125345 (uninitialized resource in WebGL, issue 550525698, reported August 21), CVE-2026-125347 (incorrect authorization in FileSystem, issue 561996724, reported September 15), CVE-2026-125343 (buffer overflow in Compositing, issue 561998123, reported September 15), CVE-2026-125348 (out-of-bounds write in GPU, issue 563358700, reported September 18) and CVE-2026-125344 (type confusion in V8, issue 568893995, reported October 2). Google reported the WebGL, FileSystem, Compositing, GPU and V8 findings internally.
   • Two fixes are rated medium: CVE-2026-125349 (uninitialized resource in GPU, issue 536663516, reported by Google on July 20) and CVE-2026-125342 (uninitialized resource in GPU, issue 566384898, reported by Vo Duc Thang, known as ugvxb, on September 26; reward pending).
   • The article says the affected components also appeared in earlier Chrome fixes, but no shared exploitation is established. The Hacker News lists no CVSS score for CVE-2026-125350 (thehackernews.com).
   • Google's Chrome Releases post dated November 9, 2026 confirms the Stable build numbers and says rollout runs over the coming days and weeks. Its security list was still marked to be updated shortly when retrieved, so the CVE list rests on the article for those items (chromereleases.googleblog.com).

   Remediation

   • Affected builds: Chrome for Windows and Mac before 157.0.8103.50/.51, and Chrome for Linux before 157.0.8103.50 (securityonline.info, chromereleases.googleblog.com).
   • Open Settings, then About Chrome, let the browser update, and click Relaunch to finish (securityonline.info). The Hacker News gives the path as More > Help > About Google Chrome followed by Relaunch (thehackernews.com). Because rollout is staggered, check the version manually (securityonline.info, chromereleases.googleblog.com).
   • Google may keep bug details restricted until most users are updated, and it keeps restrictions on bugs in third-party libraries until dependent projects are fixed (thehackernews.com).
   • Edge, Brave, Opera and Vivaldi need their own fixes for this zero-day, so watch their vendors' releases (securityonline.info, thehackernews.com).
8. securityweek.com ↗ · pub. 10/11/2026 03:12 · coletado 10/11 04:00

   Chrome Update Patches Exploited XML Zero-Day, Eighth This Year

   ler a análise desta fonte ocultar

   Google on Monday informed Chrome users of new security updates that patch nine vulnerabilities, including a zero-day exploited in the wild.

   The exploited vulnerability, tracked as CVE-2026-125350 and rated high severity, is a use-after-free in the web browser’s XML component.

9. securityonline.info ↗ · pub. 09/11/2026 20:37 · coletado 09/11 21:00 primeiro registro

   Google patches Chrome zero-day CVE-2026-125350, a use-after-free in XML exploited in the wild

   ler a análise desta fonte ocultar

   Google has shipped Chrome 157.0.8103.50/.51 to fix nine security bugs, one of them a zero-day that the company says is exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free in Chrome's XML component, reported by an anonymous researcher on November 6, 2026 and fixed within days. A crafted web page is the usual trigger for this bug class in browsers, so any unpatched desktop install is exposed to a drive-by attack. Google has not said who is behind the attacks or who they target, and it keeps bug details restricted until most users have the fix. Criticity is critical because exploitation is confirmed and the trigger is an ordinary web page, with no login or non-default setting required.

   Technical Details

   • CVE-2026-125350 is a use-after-free in the XML component. The article explains that such a bug lets an attacker who controls the freed memory corrupt data or run code (securityonline.info).
   • The same update fixes CVE-2026-125346, a second XML use-after-free, and CVE-2026-125344, a type confusion in the V8 engine (securityonline.info).
   • It also fixes a Compositing buffer overflow, a GPU out-of-bounds write, a FileSystem authorization flaw and three uninitialized resource bugs in WebGL and GPU code. The article says Google has reported no exploitation for these eight flaws (securityonline.info).
   • Google's Chrome Releases post states that the Stable channel moved to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux, with rollout over the coming days and weeks (chromereleases.googleblog.com). When that post was retrieved, its security list was still marked as to be updated shortly, so the CVE list above rests on the article alone.

   Remediation

   • Affected builds: Chrome for Windows and Mac before 157.0.8103.50/.51, and Chrome for Linux before 157.0.8103.50 (securityonline.info).
   • Open Settings, then About Chrome, let the browser update, and click Relaunch to finish. Because rollout is staggered, check the version manually (securityonline.info, chromereleases.googleblog.com).
   • Edge, Brave, Opera and other Chromium-based browsers need their own fixes for this zero-day, so watch their vendors' releases (securityonline.info).

Repetiram sem novidade

• thehackernews.com — Google patches Chrome zero-day CVE-2026-125350, an XML use-after-free exploited in the wild