CYBUNKR

Chrome zero-day:Google fixes an XML flaw that already has an exploit in the wild

Published

Google says an exploit for CVE-2026-125350, a use-after-free in Chrome’s XML handling, exists in the wild. Update Chrome to 157.0.8103.50 or later and relaunch it. Edge’s fix is not out yet.

If your team uses Google Chrome, make sure it has updated and been relaunched. Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux on 9 November, and says: “Google is aware that an exploit for CVE-2026-125350 exists in the wild” (Chrome Releases).

CVE-2026-125350 is a use-after-free in Chrome's XML handling, rated High by Google (Chrome Releases). Microsoft says it is aware of exploits in the wild and is still working on a fix for Edge (Microsoft).

Who is affected

  • Chrome for desktop before 157.0.8103.50. The update rolls out “over the coming days/weeks”, so don't assume every machine already has it (Chrome Releases).
  • Chrome Extended Stable: fixed in 156.0.8078.96 for Windows and Mac (Chrome Releases).
  • Microsoft Edge: on 9 November Microsoft said it is “actively working on releasing a security fix”. Its latest desktop Stable release, 157.0.4341.42, came out on 5 November, before Chrome's fix (Microsoft).
  • Using another browser built on Chromium? Check its maker's release notes for CVE-2026-125350.

What has been seen so far

A snapshot from 10 November:

  • The bug was reported anonymously on 6 November and fixed three days later, alongside eight other security fixes (Chrome Releases).
  • Google has not said who is using the exploit, against whom, or what it achieves, and is keeping bug details restricted until most users are updated (Chrome Releases).
  • The CVE record had not been published when we checked (CVE record), so there is no CVSS score yet, and it is not yet in CISA's Known Exploited Vulnerabilities catalog. CIRCL's Vulnerability-Lookup has logged three sightings.

What to do

  • Update Chrome now: open the menu, go to Help, then About Google Chrome, let it update and click Relaunch (Google). Check the version reads 157.0.8103.50 or later.
  • Managed devices: use your device management to push the update and make browsers relaunch, then check for machines still on older versions. A browser that is never closed never finishes updating.
  • Edge users: check edge://settings/help today and over the next few days, and update as soon as Microsoft lists the fix (Microsoft).
  • Laptops looked after by an IT provider? Ask them to confirm Chrome is on 157.0.8103.50 or later everywhere, and when Edge will be updated.

How we can help

Not sure your browsers are keeping up? Get in touch.

Sources