Google Chrome stable

exploitbulletin.com • November 10, 2026

Use-after-free in Chrome's XML component enables code execution (CVE-2026-125350)

Google confirmed on 2026-11-09 that an exploit for this flaw exists in the wild and pushed an emergency update — the eighth exploited Chrome zero-day of 2026 — so any fleet not updated and relaunched today is running a browser with a known weaponized bug.

A use-after-free in Chrome's XML component, reported anonymously on 2026-11-06, lets a malicious web page corrupt memory and execute code in the browser. Google shipped an emergency stable-channel update on 2026-11-09 and states that an exploit exists in the wild.

Affected: Google Chrome stable builds prior to the emergency update released 2026-11-09

Open Chrome's page (Help > Google Chrome) and confirm the browser is on 157.0.8103.50/.51 (Windows, Mac) or 157.0.8103.50 (Linux) or later; a pending-update indicator means the fix is downloaded but not applied until relaunch. For managed fleets, pull the browser version report from your management console and flag any endpoint still on a pre-2026-11-09 stable build.

Update Chrome to the stable release Google issued on 2026-11-09 and relaunch the browser so the update takes effect; in managed environments push the update and force a relaunch rather than waiting for users to restart.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Chrome Patches High-Risk XML Zero-Day Exploit On November 9, 2026, Google released a critical update for Chrome, addressing CVE-2026-125350, a high-severity use-after-free vulnerability in the XML component. This flaw, reported by an anonymous researcher on November 6, is actively exploited in the wild, prompting Google to warn users to update immediately. The update, which fixes a total of nine vulnerabilities, is rolling out gradually across platforms, including Windows, macOS, and Linux. Users are advised to check their Chrome version and restart the browser to apply the patch. CVE-2026-125350 is the eighth zero-day vulnerability exploited in Chrome this year, following several others that have been patched since early 2026. No specific details on the exploitation methods or targets have been disclosed by Google. 23 sources 72

Extracted Entities

Google Chrome stable

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)