Back Hkcert

Google Chrome Multiple Vulnerabilities

Hkcert • November 10, 2026

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, security restriction bypass and remote code execution on the targeted system.

CVE-2026-125350 is being exploited in the wild. A remote attacker could exploit this use-after-free vulnerability in XML. Hence, the risk level is rated as Extremely High Risk.

Remote Code Execution

Security Restriction Bypass

System / Technologies affected

Google Chrome prior to 157.0.8103.50 (Linux)

Google Chrome prior to 157.0.8103.50/.51 (Mac)

Google Chrome prior to 157.0.8103.50/.51 (Windows)

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

Google Chrome 157.0.8103.50 (Linux) or later

Google Chrome 157.0.8103.50/.51 (Mac) or later

Google Chrome 157.0.8103.50/.51 (Windows) or later

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Chrome CVE-2026-125350: High-Risk XML Vulnerability Actively Exploited Google has released a critical update for Chrome to address CVE-2026-125350, a high-severity use-after-free vulnerability in the XML component, which is actively being exploited in the wild. The flaw was reported by an anonymous researcher on November 6, 2026. This vulnerability allows attackers to potentially execute arbitrary code, leading to data corruption or program crashes. The update, which also addresses eight other vulnerabilities, is available in Chrome versions 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. Users are urged to update immediately as the exploit is confirmed to be in active use. CISA has yet to add this CVE to its Known Exploited Vulnerabilities catalog. The risk level has been rated as Extremely High by HKCERT, but Google maintains a High severity rating. As of now, no further details on the exploit method or affected users have been disclosed. 6 sources 72

Extracted Entities

Google Chrome Multiple Vulnerabilities

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)