Google patches Chrome zero-day CVE-2026-125350, an exploited XML use-after-free and the eighth of 2026, in 157.0.8103.50/.51

Linha do tempo

1. cert.cyber.gouv.fr ↗ · pub. 11/11/2026 21:00 · coletado 12/11 13:02

   Multiple unspecified security vulnerabilities patched in Google Chrome 156 and 157

   ler a análise desta fonte ocultar

   Google Chrome has addressed multiple unspecified security vulnerabilities in versions prior to 156.0.8078.100 (Extended Stable) and 157.0.8103.78/79 for Windows, Mac, and Linux. The vulnerabilities could potentially allow an attacker to cause unknown security issues. Users are urged to update to the latest versions to mitigate these risks. Detailed version management and patch notes are available in Google's official Chrome security bulletins dated November 11, 2026.

2. gbhackers.com ↗ · pub. 12/11/2026 09:06 · coletado 12/11 11:00

   Google Chrome 157.0.8103.78/.79 Fixes 83 Vulnerabilities Including Five Critical Use-After-Free Flaws

   This article expands on the scope of Chrome's November 2026 security updates, confirming the release of versions 157.0.8103.78/.79 and adding details on the breadth of vulnerabilities fixed - a total of 83 including five critical use-after-free bugs across multiple browser components. It highlights the participation of AI-assisted research teams and clarifies that, despite the critical severity, no exploitation has been observed, complementing earlier reports focused on the exploited XML use-after-free zero-day CVE-2026-125350 fixed in Chrome 157.0.8103.50/.51.

   ler a análise desta fonte ocultar

   This article expands on the scope of Chrome's November 2026 security updates, confirming the release of versions 157.0.8103.78/.79 and adding details on the breadth of vulnerabilities fixed - a total of 83 including five critical use-after-free bugs across multiple browser components. It highlights the participation of AI-assisted research teams and clarifies that, despite the critical severity, no exploitation has been observed, complementing earlier reports focused on the exploited XML use-after-free zero-day CVE-2026-125350 fixed in Chrome 157.0.8103.50/.51.

   Google released Chrome versions 157.0.8103.78/.79 for Windows and macOS and 157.0.8103.78 for Linux on November 11, 2026, addressing 83 security flaws, notably five critical use-after-free vulnerabilities affecting ServiceWorker, CSS, Layout, Skia, and Accessibility components. These critical issues, reported by various researchers throughout October and November 2026, could lead to memory corruption and potentially remote code execution if exploited, although there is no evidence of active exploitation of these specific vulnerabilities. The update also patches high-severity bugs in V8, ANGLE, Skia, SiteIsolation, and other subsystems. Google continues to limit detailed information access until the update is widely deployed, emphasizing immediate patching and version verification to mitigate risks.

3. securityonline.info ↗ · pub. 11/11/2026 23:06 · coletado 12/11 01:00

   Google Chrome 157.0.8103.78 Fixes 83 Vulnerabilities Including Five Critical Use-After-Free Bugs

   This update expands on the previously known November 9 Chrome zero-day patch by incorporating a much larger set of fixes (83 total) including five critical use-after-free vulnerabilities in key browser components besides the earlier exploited XML zero-day CVE-2026-125350. It highlights the growing role of AI-assisted research in vulnerability discovery and reports no current exploitation of these new critical bugs. The batch includes notable fixes in ServiceWorker, CSS, Layout, Skia, Accessibility, and the V8 JavaScript engine, increasing the scope and importance of the November update cycle.

   ler a análise desta fonte ocultar

   This update expands on the previously known November 9 Chrome zero-day patch by incorporating a much larger set of fixes (83 total) including five critical use-after-free vulnerabilities in key browser components besides the earlier exploited XML zero-day CVE-2026-125350. It highlights the growing role of AI-assisted research in vulnerability discovery and reports no current exploitation of these new critical bugs. The batch includes notable fixes in ServiceWorker, CSS, Layout, Skia, Accessibility, and the V8 JavaScript engine, increasing the scope and importance of the November update cycle.

   Google released Chrome 157.0.8103.78/.79 for Windows and Mac, and 157.0.8103.78 for Linux, resolving a significant batch of 83 security vulnerabilities. Among these are five critical use-after-free flaws affecting components such as ServiceWorker, CSS, Layout, Skia, and Accessibility, with the highest severity awaiting analysis (notably CVE-2026-126885). No active exploitation has been reported for this update, unlike the previous November 10 patch addressing an exploited zero-day (CVE-2026-125350). Many high-severity issues also impact V8 JavaScript engine and Skia graphics library. The update reflects advancements in AI-assisted vulnerability research, with contributions from Anthropic researchers engaged with Claude and OpenAI Codex Security, alongside Google’s internal teams. Users are urged to update immediately and relaunch their browsers to mitigate risks.

4. thehackernews.com ↗ · pub. 11/11/2026 03:04 · coletado 11/11 04:00

   Active Exploitation of Cisco BroadWorks and Openwave Messaging Flaws Despite Patches

   ler a análise desta fonte ocultar

   The U.S. CISA has added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop to its KEV catalog, citing evidence of active exploitation. CVE-2026-20320, affecting Cisco BroadWorks, allows unauthenticated remote read of sensitive info, fixed in August 2026. CVE-2026-111793 impacts Openwave Messaging Webtop, enabling authenticated users to process unintended documents, fixed in October 2026. No details confirm actual malicious use or threat actor attribution. Cisco previously disclosed active exploits in other products, prompting FCEB agency patching deadlines. Defense measures include applying updates and monitoring for exploitation signs.

5. securityonline.info ↗ · pub. 10/11/2026 21:45 · coletado 10/11 23:00

   CISA Adds Six Actively Exploited Vulnerabilities to KEV, Including Zero-Day in Chrome

   ler a análise desta fonte ocultar

   On November 10, 2026, CISA included six vulnerabilities in its KEV catalog, affecting Outlook, Chrome, Barracuda, Cisco, and Openwave. These flaws range from a Chrome zero-day to RCE chains in Barracuda appliances, with four of the six confirmed exploited in the wild. Federal agencies have tight patch deadlines, especially for Barracuda products, highlighting the urgency for organizations to update affected systems promptly.

6. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

   Google Chrome zero-day CVE-2026-125350 exploited in the wild: XML use-after-free fixed in 157.0.8103.50

   ler a análise desta fonte ocultar

   Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on 9 November 2026. The update fixes CVE-2026-125350, a use-after-free in the Chrome XML component, which Google says has an exploit in the wild. The CERT-FR advisory (cert.cyber.gouv.fr) lists sixteen CVEs for this update, but describes them only as unspecified security issues. Google's Chrome Releases page (chromereleases.googleblog.com), which was opened for this report, confirms the fixed Stable builds and says the rollout will take days to weeks, but its security section was still pending when it was read, so the exploitation statement rests on the CERT-FR advisory and on coverage that was not checked against Google's own text. Urgency is critical because the flaw is under active exploitation and the update reaches a widely used browser.

   Technical Details

   • CVE-2026-125350 is a use-after-free in the Chrome XML component, rated High by Google according to a search result from rescana.com; no CVSS score was found in the sources read.
   • The report was filed on 6 November 2026 by an anonymous researcher (windowsforum.com).
   • The sources read do not state the attack prerequisites, the attack path or the attackers; Google has withheld further technical details until more users have updated (techbooky.com).
   • The release contains nine security fixes according to windowsforum.com. The CERT-FR advisory lists sixteen CVEs, from CVE-2026-121068 to CVE-2026-125350, including CVE-2026-125346, a use-after-free in the same XML component.

   Remediation

   • Update Chrome Stable on Windows and Mac to 157.0.8103.50 or 157.0.8103.51, and Linux to 157.0.8103.50, then restart the browser (chromereleases.googleblog.com).
   • Update Chrome Extended Stable on Windows and Mac to 156.0.8078.96, as listed in the CERT-FR advisory.
   • Enterprise administrators should confirm that the update policy allows the new build and that version reporting shows 157.0.8103.50 or later on every endpoint (blog.ostorlab.co).
7. malwarebytes.com ↗ · pub. 10/11/2026 10:23 · coletado 10/11 12:01

   Google fixes Chrome zero-day CVE-2026-125350, an XML use-after-free exploited in the wild

   HKCERT published a bulletin dated November 10, 2026 that rates the Chrome update Extremely High and states that CVE-2026-125350 is being exploited in the wild (hkcert.org). The article also reports that Chrome 157.0.8103.50 for Android shipped on November 9 with the same fixes as desktop, which the existing report did not record.

   ler a análise desta fonte ocultar

   HKCERT published a bulletin dated November 10, 2026 that rates the Chrome update Extremely High and states that CVE-2026-125350 is being exploited in the wild (hkcert.org). The article also reports that Chrome 157.0.8103.50 for Android shipped on November 9 with the same fixes as desktop, which the existing report did not record.

   Google issued a Stable channel update on November 9 for Google Chrome on Windows, Mac and Linux, moving desktop builds to 157.0.8103.50/.51 (Windows and Mac) and 157.0.8103.50 (Linux), with nine security fixes. One of them is CVE-2026-125350, a high-severity use-after-free in Chrome's XML component, and Google says an exploit for it exists in the wild. Google was notified by an unnamed third party on November 6 and has not named the attackers, the targets, the delivery method or what the exploit can do. Hong Kong's HKCERT rates the overall risk as Extremely High and states that CVE-2026-125350 is being exploited, with a remote attacker able to use this XML flaw (hkcert.org). Criticity is critical because exploitation is confirmed in a browser component most users run, although the delivery vector is unknown. Because the rollout runs over days and weeks, defenders should check the installed version manually.

   Remediation

   • Update Chrome to 157.0.8103.50/.51 on Windows and Mac, or 157.0.8103.50 on Linux, then click Relaunch when prompted.
   • Android users should install Chrome 157.0.8103.50 from Google Play, which carries the same security fixes as the desktop release unless noted.
8. theregister.com ↗ · pub. 10/11/2026 10:28 · coletado 10/11 12:00

   Google patches eighth Chrome zero-day of 2026: CVE-2026-125350 use-after-free in XML exploited in the wild

   This article adds three points to the existing case. It presents the eighth zero-day as matching the full 2025 total. At retrieval the bug was not in the CISA catalog, which the earlier report did not record (rescana.com). It also corrects the earlier report on the update path: the article describes Settings, then About Chrome, not the More > Help path the earlier report attributed to the article.

   ler a análise desta fonte ocultar

   This article adds three points to the existing case. It presents the eighth zero-day as matching the full 2025 total. At retrieval the bug was not in the CISA catalog, which the earlier report did not record (rescana.com). It also corrects the earlier report on the update path: the article describes Settings, then About Chrome, not the More > Help path the earlier report attributed to the article.

   Google has patched CVE-2026-125350, a high-severity use-after-free in the XML component of Google Chrome that the company says is being exploited in the wild. The bug was reported anonymously on November 6 and is fixed in Chrome 157.0.8103.50/.51 for Windows and macOS and in 157.0.8103.50 for Linux. Google has not said who is behind the attacks or which targets are involved, and it is holding back technical details until most users have updated. The article counts this as the eighth Chrome zero-day exploited in 2026, which already equals the full 2025 total. The same release fixes a second XML use-after-free, CVE-2026-125346, which the article does not report as exploited, along with several other high-severity flaws. Criticity is critical because exploitation is confirmed in a browser that most users run, even though the vendor's rating is High and the article gives no CVSS score.

   Technical Details

   • CVE-2026-125350 is a use-after-free in the XML component. The article says it was reported anonymously on November 6 and that Google has not disclosed how the flaw is being exploited.
   • The article gives no CVSS score. Google rates the flaw High, and at retrieval it was not listed in the CISA catalog (rescana.com).
   • CVE-2026-125346 is a second XML use-after-free, reported in October by Arni Hardarson of Neonix Security. The article says Google has not indicated that it is exploited.
   • The release also fixes eight other vulnerabilities, including high-severity flaws in WebGL, FileSystem, GPU, Compositing and the V8 JavaScript engine.

   Remediation

   • Check the installed version through Settings, then About Chrome. The article says the update will roll out over the coming days and weeks, so a manual check is worth doing now.
   • Google is keeping further technical details restricted until enough users have the fix.
9. securityaffairs.com ↗ · pub. 10/11/2026 07:05 · coletado 10/11 09:00

   Google fixes eighth exploited Chrome zero-day of 2026: CVE-2026-125350 use-after-free in XML

   The article places CVE-2026-125350 as the eighth Chrome zero-day exploited in the wild in 2026 and lists the seven earlier ones, each scored CVSS 8.8, which the existing case did not record (securityaffairs.com).

   ler a análise desta fonte ocultar

   The article places CVE-2026-125350 as the eighth Chrome zero-day exploited in the wild in 2026 and lists the seven earlier ones, each scored CVSS 8.8, which the existing case did not record (securityaffairs.com).

   Google has patched nine Chrome flaws, and one of them, CVE-2026-125350, is a use-after-free in the XML component that the company says is exploited in the wild. The bulletin acknowledges that an exploit is circulating but gives no detail on how attackers use it or who they are. The bug was reported by an anonymous party on November 6, 2026, and the article counts it as the eighth Chrome zero-day exploited in 2026 (securityaffairs.com). The fixed builds are Chrome 157.0.8103.50/.51 for Windows and Mac and Chrome 157.0.8103.50 for Linux (securityaffairs.com), and Google's Chrome Releases page lists a Stable Channel Update dated November 9, 2026 (chromereleases.googleblog.com). The article gives no CVSS score for CVE-2026-125350, and the pages consulted did not show one, so the critical rating rests on confirmed exploitation and on browser memory bugs of this kind usually being reached through a web page. Defenders should treat any desktop Chrome without the new build as exposed until every machine reports the fixed version.

10. bleepingcomputer.com ↗ · pub. 10/11/2026 05:51 · coletado 10/11 07:00

    Google updates Chrome to fix eighth zero-day exploited in 2026 attacks

    ler a análise desta fonte ocultar

    Google has issued emergency security updates to fix a new Chrome vulnerability that is already being exploited in the wild, marking the eighth zero-day flaw exploited this year. The flaw, CVE-2026-125350, is a high-severity use-after-free in the XML component of Chrome, allowing memory corruption and potential arbitrary code execution. This update is critical for users across Windows, macOS, Linux, and Android platforms. Google confirms ongoing exploitation and has restricted detailed disclosures until most users are patched. The vulnerability is part of a series of zero-days addressed by Google in 2026, reflecting a particularly active threat landscape targeting Chrome browsers.

11. gbhackers.com ↗ · pub. 10/11/2026 02:26 · coletado 10/11 04:00

    Google patches Chrome zero-day CVE-2026-125350, an exploited XML use-after-free, in a nine-fix update

    This article adds the reporter and date for each of the nine fixes, including Arni Hardarson of Neonix Security as the reporter of CVE-2026-125346 on October 12, and the issue numbers and report dates for the internal and third-party findings. It also confirms that The Hacker News lists no CVSS score for CVE-2026-125350, and that Google will keep bug details restricted until most users are updated. Google's Chrome Releases post now confirms the Stable build numbers, which were not previously confirmed from Google's own page.

    ler a análise desta fonte ocultar

    This article adds the reporter and date for each of the nine fixes, including Arni Hardarson of Neonix Security as the reporter of CVE-2026-125346 on October 12, and the issue numbers and report dates for the internal and third-party findings. It also confirms that The Hacker News lists no CVSS score for CVE-2026-125350, and that Google will keep bug details restricted until most users are updated. Google's Chrome Releases post now confirms the Stable build numbers, which were not previously confirmed from Google's own page.

    Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on November 9, 2026, fixing nine security bugs. The headline flaw, CVE-2026-125350, is a use-after-free in the XML component that Google says has an exploit in the wild, but Google has not named the attackers, targets, delivery methods or exploit capabilities. The anonymous researcher who reported it did so on November 6, 2026 (thehackernews.com). Seven of the nine fixes are rated high. The article names no authentication step or non-default setting for the zero-day, and the usual delivery route for this bug class in browsers is a booby-trapped web page (cybersecuritynews.com). Criticity is critical because the flaw is exploited in the wild and can be reached through a web page, while the main limits are the unknown attackers and exploit capabilities and Google's decision to keep bug details restricted until most users are patched.

    Technical Details

    • CVE-2026-125350 is a use-after-free in the XML component, tracked as issue 582442907 and reported by an anonymous researcher on November 6, 2026. Google says an exploit exists in the wild but has not described how it is used. Such bugs can cause data corruption, crashes or arbitrary code execution, and Google has not confirmed which of these outcomes applies here (thehackernews.com).
    • CVE-2026-125346 is a second XML use-after-free (issue 572578603), reported on October 12, 2026 by Arni Hardarson of Neonix Security. Google has not identified it as exploited, and its reward is undetermined.
    • Seven fixes are rated high: CVE-2026-125350, CVE-2026-125346, CVE-2026-125345 (uninitialized resource in WebGL, issue 550525698, reported August 21), CVE-2026-125347 (incorrect authorization in FileSystem, issue 561996724, reported September 15), CVE-2026-125343 (buffer overflow in Compositing, issue 561998123, reported September 15), CVE-2026-125348 (out-of-bounds write in GPU, issue 563358700, reported September 18) and CVE-2026-125344 (type confusion in V8, issue 568893995, reported October 2). Google reported the WebGL, FileSystem, Compositing, GPU and V8 findings internally.
    • Two fixes are rated medium: CVE-2026-125349 (uninitialized resource in GPU, issue 536663516, reported by Google on July 20) and CVE-2026-125342 (uninitialized resource in GPU, issue 566384898, reported by Vo Duc Thang, known as ugvxb, on September 26; reward pending).
    • The article says the affected components also appeared in earlier Chrome fixes, but no shared exploitation is established. The Hacker News lists no CVSS score for CVE-2026-125350 (thehackernews.com).
    • Google's Chrome Releases post dated November 9, 2026 confirms the Stable build numbers and says rollout runs over the coming days and weeks. Its security list was still marked to be updated shortly when retrieved, so the CVE list rests on the article for those items (chromereleases.googleblog.com).

    Remediation

    • Affected builds: Chrome for Windows and Mac before 157.0.8103.50/.51, and Chrome for Linux before 157.0.8103.50 (securityonline.info, chromereleases.googleblog.com).
    • Open Settings, then About Chrome, let the browser update, and click Relaunch to finish (securityonline.info). The Hacker News gives the path as More > Help > About Google Chrome followed by Relaunch (thehackernews.com). Because rollout is staggered, check the version manually (securityonline.info, chromereleases.googleblog.com).
    • Google may keep bug details restricted until most users are updated, and it keeps restrictions on bugs in third-party libraries until dependent projects are fixed (thehackernews.com).
    • Edge, Brave, Opera and Vivaldi need their own fixes for this zero-day, so watch their vendors' releases (securityonline.info, thehackernews.com).
12. securityweek.com ↗ · pub. 10/11/2026 03:12 · coletado 10/11 04:00

    Chrome zero-day CVE-2026-125350 exploited in the wild, eighth of 2026

    ler a análise desta fonte ocultar

    Google has released Chrome 157.0.8103.50/.51 fixing nine vulnerabilities, including a high-severity use-after-free (CVE-2026-125350) in the XML component that has been exploited in the wild. The zero-day was reported anonymously on November 6, and, as of the latest updates, no details about the attack methods or targets are publicly available. This marks the eighth exploited zero-day in Chrome so far in 2026, reflecting a concerning attack pattern after multiple other vulnerabilities.

    The patch also addresses six high-severity bugs across WebGL, FileSystem, Compositing, GPU, and V8, as well as two medium-severity issues involving uninitialized resources in GPU components. The updates are included in Chrome 157 for Windows, Mac, and Linux, and on Android their fix is also rolled out. The vulnerabilities are mostly internally discovered by Google.

    Differing reports note a total remediation of nine to sixteen CVEs in this update, and CISA recently added the zero-day CVE-2026-125350 to its KEV catalog with a deadline of November 24 for affected entities. Organizations are advised to update their Chrome browsers promptly to mitigate ongoing risk.

13. securityonline.info ↗ · pub. 09/11/2026 20:37 · coletado 09/11 21:00 primeiro registro

    Google patches Chrome zero-day CVE-2026-125350, a use-after-free in XML exploited in the wild

    ler a análise desta fonte ocultar

    Google has shipped Chrome 157.0.8103.50/.51 to fix nine security bugs, one of them a zero-day that the company says is exploited in the wild. The flaw, CVE-2026-125350, is a use-after-free in Chrome's XML component, reported by an anonymous researcher on November 6, 2026 and fixed within days. A crafted web page is the usual trigger for this bug class in browsers, so any unpatched desktop install is exposed to a drive-by attack. Google has not said who is behind the attacks or who they target, and it keeps bug details restricted until most users have the fix. Criticity is critical because exploitation is confirmed and the trigger is an ordinary web page, with no login or non-default setting required.

    Technical Details

    • CVE-2026-125350 is a use-after-free in the XML component. The article explains that such a bug lets an attacker who controls the freed memory corrupt data or run code (securityonline.info).
    • The same update fixes CVE-2026-125346, a second XML use-after-free, and CVE-2026-125344, a type confusion in the V8 engine (securityonline.info).
    • It also fixes a Compositing buffer overflow, a GPU out-of-bounds write, a FileSystem authorization flaw and three uninitialized resource bugs in WebGL and GPU code. The article says Google has reported no exploitation for these eight flaws (securityonline.info).
    • Google's Chrome Releases post states that the Stable channel moved to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux, with rollout over the coming days and weeks (chromereleases.googleblog.com). When that post was retrieved, its security list was still marked as to be updated shortly, so the CVE list above rests on the article alone.

    Remediation

    • Affected builds: Chrome for Windows and Mac before 157.0.8103.50/.51, and Chrome for Linux before 157.0.8103.50 (securityonline.info).
    • Open Settings, then About Chrome, let the browser update, and click Relaunch to finish. Because rollout is staggered, check the version manually (securityonline.info, chromereleases.googleblog.com).
    • Edge, Brave, Opera and other Chromium-based browsers need their own fixes for this zero-day, so watch their vendors' releases (securityonline.info).

Repetiram sem novidade

• thehackernews.com — Google patches Chrome zero-day CVE-2026-125350, an XML use-after-free exploited in the wild