CriticalZero-DayCVE-2026-125350
CVE-2026-125350: Google Fixes Exploited Chrome XML Zero-Day
SOCRadar·Source published ·1 min read
What happened?
Google has patched CVE-2026-125350, a high-severity use-after-free in Chrome’s XML handling that attackers are already exploiting. The fix landed in the Stable channel on November 9, 2026, three days after an anonymous researcher reported the bug. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild. It is the eighth exploited Chrome zero-day of 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on November 10. What Is CVE-2026-125350?