High
Google Chrome, zero-day, CVE-2026-125350, use-after-free, XML, browser security, Chromium, Edge
Chrome Zero-Day CVE-2026-125350: Exploited XML Use-After-Free
Chrome zero-day CVE-2026-125350, a use-after-free in XML, is exploited in the wild. The eighth of 2026. Update to Chrome 157.0.8103.50 and relaunch.
CVE-2026-125350 is a use-after-free bug in Chrome's XML component that Google says is being exploited in the wild. It is the eighth Chrome zero-day patched in 2026. Update to Chrome 157.0.8103.50 or .51 on Windows and macOS, or 157.0.8103.50 on Linux, then relaunch the browser. Edge, Brave, Opera and Vivaldi need their own updates.
Google shipped the fix on November 9 in a Stable Channel update that patches nine security issues. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the advisory says. An anonymous researcher reported the bug on November 6, so the patch landed three days later. Google is withholding technical details until most users have updated, and says restrictions stay if the bug is in a third-party library other projects have not fixed yet.
A use-after-free (CWE-416) happens when code frees a piece of memory and then keeps using a pointer to it. An attacker who controls what lands in that freed memory can corrupt data or run code, usually inside Chrome's renderer sandbox; taking over the whole machine typically needs a second, sandbox-escape bug. Google rates this one High and, as is usual for its zero-days, has not said who used it or against whom, per BleepingComputer. The same release fixes a second XML use-after-free, CVE-2026-125346, reported in October.
Is CVE-2026-125350 being exploited?
Yes. Google confirms an exploit exists in the wild. The CVE is not yet in CISA's Known Exploited Vulnerabilities catalog as of November 10, and NVD has not scored it, so CVSS and EPSS are not available yet. That is normal for a bug disclosed the same day, and it is exactly the case where those scores lag the real risk.
Which Chrome version fixes CVE-2026-125350?
Platform | Fixed version | How to check |
|---|---|---|
Windows | 157.0.8103.50 or .51 | Menu > Help > About Google Chrome, then Relaunch |
macOS | 157.0.8103.50 or .51 | Same as above |
Linux | 157.0.8103.50 | Package manager or About page |
Edge, Brave, Opera, Vivaldi | Vendor update based on this Chromium fix | Check each browser's release notes |
Chrome downloads updates on its own but only applies them after a restart, which is why the relaunch step matters. For managed fleets, check the version your reporting shows, not just that the policy pushed it, and set a relaunch deadline.
How many Chrome zero-days have there been in 2026?
Eight. According to The Hacker News, the earlier seven are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491. We covered the V8 zero-day CVE-2026-85046 and the BlueMoon exploit kit that chained Chrome and Windows bugs. Google fixed eight exploited Chrome zero-days in all of 2025, according to BleepingComputer, so 2026 has already matched that.
Our read
The useful signal here is speed, not severity labels: three days from report to fix, with no CVSS, EPSS or KEV entry yet. A prioritization process that waits for those scores would leave this unpatched while it is being used. Our guide to what a zero-day vulnerability is and how to prioritize beyond CVSS cover how to handle a vendor-confirmed exploit before the scores arrive. For browser fleets, the gap to close is relaunch, not download.
Reporting by BleepingComputer and The Hacker News; fix per Google Chrome Releases.