CriticalPhishing
Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely
Cyber Security News·Source published ·1 min read
What happened?
Google has fixed a Chrome zero-day that attackers are already using. The flaw is tracked as CVE-2026-125350, and it lets a remote attacker run malicious code in the browser. Google’s Stable channel update moves Chrome to version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The rollout will reach users over the coming days and weeks. The Chrome Security team explains that bug details stay locked until most users have the fix. CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component.
Key details
- The flaw is a high-severity use-after-free bug in Chrome's XML component.
- An anonymous researcher reported the vulnerability on November 6, 2026.
- The update includes nine security fixes total, seven rated High severity.
- Extended Stable channel receives the same zero-day patch in version 156.0.8078.96.
- Attackers can exploit the flaw through a booby-trapped web page opened by the victim.
- Chromium-based browsers share the same engine code and need vendor patches.
Affected
- Google Chrome Stable channel versions before 157.0.8103.50/.51 on Windows and Mac.
- Google Chrome Extended Stable channel versions before 156.0.8078.96.
- Chromium-based browsers that share the same engine code.
Fixes and mitigations
- Update Chrome Stable to version 157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux.
- Linux users should update through their package manager.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.