HighZero-DayCVE-2026-125350
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
The Hacker News·Source published ·1 min read
What happened?
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.
Key details
- Google released Chrome updates fixing nine vulnerabilities including one actively exploited zero-day.
- An anonymous researcher reported the vulnerability to Google on November 6, 2026.
- Google confirmed an exploit for CVE-2026-125350 exists in the wild but gave no details on attacks.
- This marks the eighth actively exploited Chrome zero-day patched by Google in 2026.
- Users should update Chrome to version 157.0.8103.50/.51 on Windows and macOS or 157.0.8103.50 on Linux.
- Chromium-based browsers like Edge, Brave, Opera, and Vivaldi also need to apply the fixes when available.
Affected
- Google Chrome versions prior to 157.0.8103.50/.51 on Windows and macOS and prior to 157.0.8103.50 on Linux.
- Other Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi.
Fixes and mitigations
- Update Chrome to 157.0.8103.50/.51 on Windows and macOS or 157.0.8103.50 on Linux via About Google Chrome.
- Apply fixes for Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi when they become available.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.