Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

Google patches exploited Chrome XML flaw in latest update

Part of the CVE-2026-125350 story · since 10 Nov

Developinglatest 2 hours ago3 articles3 outlets
10 Nov · SecurityOnline firstNowThis article2nd of 3
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
  • Tue 10 Nov, 07:00 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update. This article, 2nd of 3.
  • Tue 10 Nov, 08:00 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component.

Google has released Chrome updates fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in the browser’s XML component that Google says has been exploited in the wild. An anonymous researcher reported the vulnerability to Google on 6 November. Google has not provided details of the attacks, and the US Cybersecurity and Infrastructure Security Agency has not added the flaw to its Known Exploited Vulnerabilities catalogue.

Google’s update also fixes six high-severity vulnerabilities affecting WebGL, FileSystem, Compositing, GPU, V8 and XML components; Google discovered most of these flaws internally. Two medium-severity uninitialised-resource bugs in the GPU component were also addressed. The updates are Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux.

SecurityWeek described CVE-2026-125350 as Chrome’s eighth zero-day exploited this year, following seven earlier vulnerabilities.

How the story developed

All 3 articles
Developinglatest 2 hours ago3 articles3 outlets

3 articles from 3 outlets since 10 Nov. Still developing; the latest report was 2 hours ago. This was the 2nd report, 5 hours after the first.

Now10 NovFirst reportSecurityOnline · 10 Nov, 01:31This article2nd of 3 · day 0
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
  • Tue 10 Nov, 07:00 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update. This article, 2nd of 3.
  • Tue 10 Nov, 08:00 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 3 articles as a list
  1. Tue 10 NovDay 03
    1. Google patches Chrome zero day exploited in the wild01:31 · SecurityOnline · First report
    2. Google patches exploited Chrome XML flaw in latest update07:00 · SecurityWeek · This article, 2nd of 3
    3. Google patches actively exploited flaw in Chrome XML component08:00 · The Hacker News

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in