Vulnerabilities · 2 days ago
Google’s Chrome 157 update fixes nine flaws, including an XML use-after-free that Google says is under active exploitation; SecurityWeek counts it as the browser’s eighth exploited zero-day of 2026. The issue is CVE-2026-125350. Google has not named an attacker or described the attacks, and is restricting technical details while users update.
CSIRT Italia says a user need only visit a prepared webpage: its XML content can make Chrome access memory it has already freed. An attacker can then corrupt memory in the affected process and, in some circumstances, execute code. Reporting does not establish whether exploitation escaped Chrome’s sandbox or what attackers did afterward.
If Chrome is routine software across your managed endpoints, ordinary browsing puts users in the potential attack path. The update closes the known flaw, but Google’s limited account leaves whether any particular organization was targeted—and what followed a successful exploit—unanswered.
Published Nov 10 by Chrome
Known exploited · CISA KEV
CVSS 8.8 HIGH: use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CISA federal remediation date Nov 24
5 sources covering this story
Chrome zero-day whack-a-mole continues as 2026 tally hits 8
Another Chrome memory bug gets squashed, but not before attackers got their hands on it
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
Risolte vulnerabilità in Google Chrome
Tra queste si evidenzia la CVE-2026-125350 che risulta sfruttata attivamente in rete.
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google patches nine Chrome flaws, including actively exploited CVE-2026-125350, a high-severity use-after-free vulnerability in the XML component.
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.
Part of the PlainSec briefing for 2026-11-11