Google Chrome zero-day CVE-2026-125350 exploited in the wild: XML use-after-free fixed in 157.0.8103.50
Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on 9 November 2026. The update fixes CVE-2026-125350, a use-after-free in the Chrome XML component, which Google says has an exploit in the wild. The CERT-FR advisory (cert.cyber.gouv.fr) lists sixteen CVEs for this update, but describes them only as unspecified security issues. Google's Chrome Releases page (chromereleases.googleblog.com), which was opened for this report, confirms the fixed Stable builds and says the rollout will take days to weeks, but its security section was still pending when it was read, so the exploitation statement rests on the CERT-FR advisory and on coverage that was not checked against Google's own text. Urgency is critical because the flaw is under active exploitation and the update reaches a widely used browser.
Entenda a falha
A vulnerabilidade
CVE-2026-125350 is a use-after-free in the XML component of Google Chrome, and Google says an exploit exists in the wild. The sources read do not state the attack prerequisites (network reach, user interaction) or what the attacker gains. Google rates it High according to a search result from rescana.com, and no CVSS score was found. It is fixed in Stable 157.0.8103.50 (Windows, Linux) and 157.0.8103.51 (Mac), and in Extended Stable 156.0.8078.96 for Windows and Mac. CERT-FR lists fifteen other CVEs in the same update as unspecified security issues. One of them, CVE-2026-125346, is also a use-after-free in the XML component.
Como funciona
The sources do not describe the exact sequence of the bug, because Google has withheld technical details until more users have updated. In general terms, a use-after-free in an XML component means the browser handles XML data, releases a piece of memory, and later still uses a reference to it. At that point the browser works on memory that may have been reused for something else. What triggers it in Chrome and how it is exploited are not stated.
Por que é vulnerável
The root cause class is a memory-lifetime error: an object in the XML component is used after it was freed. The articles do not explain the specific code path, why it went unnoticed, or what exactly the fix changes. The fix ships in the updated Chrome builds.
Como foi descoberta
According to windowsforum.com, the report was filed on 6 November 2026 by an anonymous researcher. Google says CVE-2026-125350 is actively exploited, a statement relayed by the CERT-FR advisory, and the fix was released on 9 November 2026. Google's security section was still pending when read, so the exploitation claim was not checked against Google's own text. Google is withholding further details until more users have updated.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Google says an exploit for CVE-2026-125350 is being used in the wild, but no article shows a published proof of concept or describes how the exploit works. No public copy is known, so it is treated as private. Because the flaw is under active exploitation, patching is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:49.
Detalhes técnicos
- CVE-2026-125350 is a use-after-free in the Chrome XML component, rated High by Google according to a search result from rescana.com; no CVSS score was found in the sources read.
- The report was filed on 6 November 2026 by an anonymous researcher (windowsforum.com).
- The sources read do not state the attack prerequisites, the attack path or the attackers; Google has withheld further technical details until more users have updated (techbooky.com).
- The release contains nine security fixes according to windowsforum.com. The CERT-FR advisory lists sixteen CVEs, from CVE-2026-121068 to CVE-2026-125350, including CVE-2026-125346, a use-after-free in the same XML component.
Remediação
- Update Chrome Stable on Windows and Mac to 157.0.8103.50 or 157.0.8103.51, and Linux to 157.0.8103.50, then restart the browser (chromereleases.googleblog.com).
- Update Chrome Extended Stable on Windows and Mac to 156.0.8078.96, as listed in the CERT-FR advisory.
- Enterprise administrators should confirm that the update policy allows the new build and that version reporting shows 157.0.8103.50 or later on every endpoint (blog.ostorlab.co).
Linha do tempo
-
Google Chrome zero-day CVE-2026-125350 exploited in the wild: XML use-after-free fixed in 157.0.8103.50
ler a análise desta fonte ocultar
Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on 9 November 2026. The update fixes CVE-2026-125350, a use-after-free in the Chrome XML component, which Google says has an exploit in the wild. The CERT-FR advisory (cert.cyber.gouv.fr) lists sixteen CVEs for this update, but describes them only as unspecified security issues. Google's Chrome Releases page (chromereleases.googleblog.com), which was opened for this report, confirms the fixed Stable builds and says the rollout will take days to weeks, but its security section was still pending when it was read, so the exploitation statement rests on the CERT-FR advisory and on coverage that was not checked against Google's own text. Urgency is critical because the flaw is under active exploitation and the update reaches a widely used browser.
Technical Details
- CVE-2026-125350 is a use-after-free in the Chrome XML component, rated High by Google according to a search result from rescana.com; no CVSS score was found in the sources read.
- The report was filed on 6 November 2026 by an anonymous researcher (windowsforum.com).
- The sources read do not state the attack prerequisites, the attack path or the attackers; Google has withheld further technical details until more users have updated (techbooky.com).
- The release contains nine security fixes according to windowsforum.com. The CERT-FR advisory lists sixteen CVEs, from CVE-2026-121068 to CVE-2026-125350, including CVE-2026-125346, a use-after-free in the same XML component.
Remediation
- Update Chrome Stable on Windows and Mac to 157.0.8103.50 or 157.0.8103.51, and Linux to 157.0.8103.50, then restart the browser (chromereleases.googleblog.com).
- Update Chrome Extended Stable on Windows and Mac to 156.0.8078.96, as listed in the CERT-FR advisory.
- Enterprise administrators should confirm that the update policy allows the new build and that version reporting shows 157.0.8103.50 or later on every endpoint (blog.ostorlab.co).