Google patches Chrome zero-day CVE-2026-125350, a use-after-free in XML exploited in the wild
Google has shipped Chrome 157.0.8103.50/.51 to fix nine security bugs, one of them a zero-day that the company says is exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free in Chrome's XML component, reported by an anonymous researcher on November 6, 2026 and fixed within days. A crafted web page is the usual trigger for this bug class in browsers, so any unpatched desktop install is exposed to a drive-by attack. Google has not said who is behind the attacks or who they target, and it keeps bug details restricted until most users have the fix. Criticity is critical because exploitation is confirmed and the trigger is an ordinary web page, with no login or non-default setting required.
Entenda a falha
A vulnerabilidade
CVE-2026-125350 is a use-after-free in the XML component of Google Chrome. Google says an exploit for it exists in the wild. In browsers, a crafted web page is the usual trigger, so the articles point to no login or special setting. An attacker could corrupt data or run code. Chrome for Windows and Mac before 157.0.8103.50/.51 and Chrome for Linux before 157.0.8103.50 are affected, and those versions fix it. The same update fixes CVE-2026-125346, a second XML use-after-free, and CVE-2026-125344, a type confusion in the V8 engine. Google reports no exploitation of these two or of the other six bugs fixed.
Como funciona
The articles do not describe the exact code path. They say that in browsers this kind of bug is usually triggered by a crafted web page. The page's content reaches Chrome's XML component, which handles memory during processing. At some point the software frees a block of memory but keeps using it afterwards.
Por que é vulnerável
The root cause is a use-after-free: the software keeps using memory after it has been freed. An attacker who controls that memory can often corrupt data or run code. The articles do not say why the bug went unnoticed or what the patch changes in the code. Google keeps the bug details restricted until most users have the fix.
Como foi descoberta
An anonymous researcher reported CVE-2026-125350 to Google on November 6, 2026, and the fix shipped days later. Google's advisory says it is aware that an exploit exists in the wild, but it has not said who is behind the attacks or who they target. The articles do not say how the researcher found the flaw or whether the weakness had been seen before. Google is holding back bug details until most users are updated.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Google says an exploit for CVE-2026-125350 exists in the wild, so attackers already have a working exploit. No article says a copy was published, and Google keeps the technical details restricted. Its maturity is confirmed in-the-wild use, with no further detail on how it works. Patching is urgent: update Chrome to 157.0.8103.50/.51 (Windows/Mac) or .50 (Linux) and check the version manually, since the rollout is staggered.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 21:16.
Detalhes técnicos
- CVE-2026-125350 is a use-after-free in the XML component. The article explains that such a bug lets an attacker who controls the freed memory corrupt data or run code (securityonline.info).
- The same update fixes CVE-2026-125346, a second XML use-after-free, and CVE-2026-125344, a type confusion in the V8 engine (securityonline.info).
- It also fixes a Compositing buffer overflow, a GPU out-of-bounds write, a FileSystem authorization flaw and three uninitialized resource bugs in WebGL and GPU code. The article says Google has reported no exploitation for these eight flaws (securityonline.info).
- Google's Chrome Releases post states that the Stable channel moved to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux, with rollout over the coming days and weeks (chromereleases.googleblog.com). When that post was retrieved, its security list was still marked as to be updated shortly, so the CVE list above rests on the article alone.
Remediação
- Affected builds: Chrome for Windows and Mac before 157.0.8103.50/.51, and Chrome for Linux before 157.0.8103.50 (securityonline.info).
- Open Settings, then About Chrome, let the browser update, and click Relaunch to finish. Because rollout is staggered, check the version manually (securityonline.info, chromereleases.googleblog.com).
- Edge, Brave, Opera and other Chromium-based browsers need their own fixes for this zero-day, so watch their vendors' releases (securityonline.info).
Linha do tempo
-
Google patches Chrome zero-day CVE-2026-125350, a use-after-free in XML exploited in the wild
ler a análise desta fonte ocultar
Google has shipped Chrome 157.0.8103.50/.51 to fix nine security bugs, one of them a zero-day that the company says is exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free in Chrome's XML component, reported by an anonymous researcher on November 6, 2026 and fixed within days. A crafted web page is the usual trigger for this bug class in browsers, so any unpatched desktop install is exposed to a drive-by attack. Google has not said who is behind the attacks or who they target, and it keeps bug details restricted until most users have the fix. Criticity is critical because exploitation is confirmed and the trigger is an ordinary web page, with no login or non-default setting required.
Technical Details
- CVE-2026-125350 is a use-after-free in the XML component. The article explains that such a bug lets an attacker who controls the freed memory corrupt data or run code (securityonline.info).
- The same update fixes CVE-2026-125346, a second XML use-after-free, and CVE-2026-125344, a type confusion in the V8 engine (securityonline.info).
- It also fixes a Compositing buffer overflow, a GPU out-of-bounds write, a FileSystem authorization flaw and three uninitialized resource bugs in WebGL and GPU code. The article says Google has reported no exploitation for these eight flaws (securityonline.info).
- Google's Chrome Releases post states that the Stable channel moved to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux, with rollout over the coming days and weeks (chromereleases.googleblog.com). When that post was retrieved, its security list was still marked as to be updated shortly, so the CVE list above rests on the article alone.
Remediation
- Affected builds: Chrome for Windows and Mac before 157.0.8103.50/.51, and Chrome for Linux before 157.0.8103.50 (securityonline.info).
- Open Settings, then About Chrome, let the browser update, and click Relaunch to finish. Because rollout is staggered, check the version manually (securityonline.info, chromereleases.googleblog.com).
- Edge, Brave, Opera and other Chromium-based browsers need their own fixes for this zero-day, so watch their vendors' releases (securityonline.info).