Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Google patches actively exploited flaw in Chrome XML component

Part of the CVE-2026-125350 story · since 10 Nov

Developinglatest 2 hours ago3 articles3 outlets
10 Nov · SecurityOnline firstNowThis article3rd of 3
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
  • Tue 10 Nov, 07:00 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update.
  • Tue 10 Nov, 08:00 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component. This article, 3rd of 3.

Google has released a desktop Chrome security update to patch nine vulnerabilities, including one actively exploited in the wild. The high‑severity flaw is CVE-2026-125350, described as a use‑after‑free bug in the XML component. Google notes that an anonymous researcher reported the flaw on 6 November 2026 and that there is active exploitation but provides no further detail on real‑world abuse or perpetrators.

The company added that bug details may remain restricted until most users are updated, and that third‑party library dependencies may retain restrictions if affected.

This release forms part of a running tally of eight Chrome zero‑days exploited in the wild since the start of 2026, with CVEs including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. Google advises users to update to Chrome versions 157.0.8103.50/.51 on Windows and macOS, and 157.0.8103.50 on Linux, via More > Help > About Google Chrome and Relaunch.

The guidance also extends to users of other Chromium‑based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, to apply the fixes as they become available. The Hacker News attributes these points to Google’s Chromium updater and related disclosures.

How the story developed

All 3 articles
Developinglatest 2 hours ago3 articles3 outlets

3 articles from 3 outlets since 10 Nov. Still developing; the latest report was 2 hours ago. This was the 3rd report, 6 hours after the first.

Now10 NovFirst reportSecurityOnline · 10 Nov, 01:31This article3rd of 3 · day 0
  • Tue 10 Nov, 01:31 UTC. SecurityOnline, first report. Google patches Chrome zero day exploited in the wild.
  • Tue 10 Nov, 07:00 UTC. SecurityWeek, its first report on the story. Google patches exploited Chrome XML flaw in latest update.
  • Tue 10 Nov, 08:00 UTC. The Hacker News, its first report on the story. Google patches actively exploited flaw in Chrome XML component. This article, 3rd of 3.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 3 articles as a list
  1. Tue 10 NovDay 03
    1. Google patches Chrome zero day exploited in the wild01:31 · SecurityOnline · First report
    2. Google patches exploited Chrome XML flaw in latest update07:00 · SecurityWeek
    3. Google patches actively exploited flaw in Chrome XML component08:00 · The Hacker News · This article, 3rd of 3

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in