Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Google patches Chrome zero day exploited in the wild

Part of the CVE-2026-125350 story · since 10 Nov

Developinglatest 2 hours ago5 articles5 outlets
10 Nov · SecurityOnline firstNowThis article4th of 5
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
  • Tue 10 Nov, 07:00 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update.
  • Tue 10 Nov, 08:00 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component.
  • Tue 10 Nov, 12:00 UTC. Security Affairs, its first report on the story. Google patches Chrome zero day exploited in the wild. This article, 4th of 5.
  • Tue 10 Nov, 14:30 UTC. Malwarebytes, its first report on the story. Google updates Chrome to fix actively exploited zero day.

Google has patched multiple Chrome vulnerabilities, including CVE-2026-125350, the eighth actively exploited zero-day in Chrome for 2026. The flaw is described as a use-after-free in XML handling and attackers have been observed exploiting it in the wild. Google’s advisory notes that details and exploit specifics may remain restricted until a majority of users are updated.

Chrome versions addressed in the update are 157.0.8103.50/51 for Windows and macOS, and 157.0.8103.50 for Linux, with the rollout expected to be gradual over the coming days and weeks.

The security bulletin lists several previously exploited Chrome flaws addressed this year. In February 2026, CVE-2026-2441 (CVSS 8.8) was a use-after-free in CSS. March 2026 saw CVE-2026-3909 (CVSS 8.8) for an out-of-bounds write in the Skia library and CVE-2026-3910 (CVSS 8.8) for the V8 engine. April 2026 brought CVE-2026-5281 (CVSS 8.8) a use-after-free in Dawn/WebGPU.

June 2026 covered CVE-2026-11645 (CVSS 8.8) an out-of-bounds memory access in V8, while September 2026 included CVE-2026-85046 (CVSS 8.8) a V8 type confusion flaw and CVE-2026-87491 (CVSS 8.8) an out-of-bounds write in V8. The article cites these as previously exploited flaws addressed alongside CVE-2026-125350.

How the story developed

All 5 articles
Developinglatest 2 hours ago5 articles5 outlets

5 articles from 5 outlets since 10 Nov. Still developing; the latest report was 2 hours ago. This was the 4th report, 10 hours after the first.

Now10 NovFirst reportSecurityOnline · 10 Nov, 01:31This article4th of 5 · day 0
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
  • Tue 10 Nov, 07:00 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update.
  • Tue 10 Nov, 08:00 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component.
  • Tue 10 Nov, 12:00 UTC. Security Affairs, its first report on the story. Google patches Chrome zero day exploited in the wild. This article, 4th of 5.
  • Tue 10 Nov, 14:30 UTC. Malwarebytes, its first report on the story. Google updates Chrome to fix actively exploited zero day.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 5 articles as a list
  1. Tue 10 NovDay 05
    1. Google patches Chrome zero day exploited in the wild01:31 · SecurityOnline · First report
    2. Google patches exploited Chrome XML flaw in latest update07:00 · SecurityWeek
    3. Google patches Chrome zero day exploited in the wild12:00 · Security Affairs · This article, 4th of 5
    Show 2 more from 10 Nov
    1. Google patches actively exploited flaw in Chrome XML component08:00 · The Hacker News
    2. Google updates Chrome to fix actively exploited zero day14:30 · Malwarebytes

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in