🔍 Read the full analysis: Chrome’s Eighth Zero-Day This Year: Understanding The XML Bug on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome updates on November 9, 2026, fixing CVE-2026-125350, a high-severity use-after-free flaw in XML handling that the company says is being exploited. The source counts it as Chrome’s eighth vulnerability flagged as exploited in the wild this year. Attack details and affected targets have not been disclosed.
Google released Chrome updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that the company says is being exploited in the wild. The source’s count of Google release notes makes it the eighth Chrome flaw flagged as exploited in 2026; Google has not disclosed who is behind the attacks, who may have been targeted or how the exploit works.
Google’s Stable Channel release notes describe CVE-2026-125350 as “Use after free in XML” and rate it high severity. The notes state: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” That confirms Google knows of real-world exploitation, but the published information does not establish the scale or results of any attacks. The bug was reported by an anonymous researcher on November 6, according to Google, and a fix shipped three days later.
Google lists fixed desktop versions as 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. Organizations using Extended Stable on Windows and Mac are directed to version 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days.
The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second flaw is being exploited. The source reports that Microsoft had not yet listed a fixed Edge version as of November 10, while Vivaldi said its desktop update included a fix for CVE-2026-125350. Users of other Chromium-based browsers should check their own vendors’ release notes rather than assume Chrome’s update has been applied to them.
Chrome’s Eighth Zero-Day This Year Understanding the XML Bug
Google fixed a high-severity XML flaw that it says is being exploited. Updates are rolling out, and the attack details remain undisclosed.
What the flaw means
CVE-2026-125350 is a use-after-free flaw in Chrome’s XML component.
Real-world exploitation
Google says an exploit exists in the wild, but has not described its capabilities or confirmed the impact of attacks.
Another XML flaw
The update also fixes CVE-2026-125346. Google’s notes do not say this second flaw is being exploited.
Report to release
Google’s notes give a short timeline, without saying when exploitation began.
Check your browser
The fix rolls out gradually; verify that it is installed and active.
- On desktop, open Help, then About Google Chrome to check for an update.
- If Chrome downloads an update, select Relaunch to apply it.
- On Android, check Google Play and review the version in Chrome settings.
- For Edge and other Chromium-based browsers, check that vendor’s release notes and fixed version.
Why the Exploited XML Flaw Matters
The immediate concern is that the flaw is already being exploited, while Google’s fixes are rolling out gradually. Users who rely on automatic updates may not receive the patch at the same moment, and downloading an update is not enough if the browser still needs to restart. Checking Chrome’s version and relaunching after an update are practical ways to confirm the fix is active.
A use-after-free is a memory-management error: software continues to use memory after releasing it. Depending on the circumstances, that class of bug can lead to crashes, data corruption or code execution, as The Hacker News noted. Those are general risks of the bug type, not confirmed outcomes of this particular exploit. Google has not described the exploit’s capabilities, so the specific consequences cannot be stated from the available information.
The incident also matters beyond Chrome because several browsers use Chromium. Their makers must distribute and, in some cases, integrate the relevant fix in their own releases. The source’s tally of eight exploited Chrome flaws this year is based on Google’s release notes; it is a count of vulnerabilities Google flagged as exploited, not a measure of the number of attacks or affected people.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
How Google Identified and Patched It
The timeline in Google’s release notes is short: an anonymous researcher reported the bug on Friday, November 6, and Google published the fixed Chrome versions on Monday, November 9. Google’s notice does not give further details about the report or say when exploitation began. The term zero-day is used here because exploitation was reported before the public release of the fix; the source does not provide a detailed chronology of attackers’ access to the flaw.
The source counted eight 2026 vulnerabilities for which Google said it was aware of exploitation in the wild: CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; CVE-2026-85046 and CVE-2026-87491 in September; and CVE-2026-125350 in November. It says four of those eight involved V8, Chrome’s JavaScript engine. This history provides a tally from release notes, but does not by itself show that the flaws are connected or that attacks followed the same pattern.
XML is a structured text format browsers may encounter in documents and graphics, including SVG. Google has not identified which part of Chrome’s XML handling is affected. The source also reports no Chrome for iOS or ChromeOS release note mentioning this flaw as of November 10; that is a snapshot of the material checked, not confirmation that those platforms are unaffected.
““Use after free in XML.””
— Google, describing CVE-2026-125350
What Google Has Not Disclosed
Google has not identified the attackers, targets or attack method, and it has not explained which XML-handling code is vulnerable. The available notice does not say how widespread exploitation is, when it began, or whether attacks resulted in data theft, code execution or other harm. Those details remain unknown; potential effects associated with use-after-free bugs should not be treated as confirmed outcomes here.
The rollout is also still developing. Google said desktop updates would take days or weeks to reach users and that Android availability would follow through Google Play. As of the source’s November 10 check, no Chrome for iOS or ChromeOS post mentioning the flaw had been found. That does not establish whether those products are affected or whether a related update will be posted. Browser versions and vendor statements can change after that check.
Check the Browser Update Status
Chrome users should open the browser menu, choose Help and then About Google Chrome to view the installed version and check for an update. If Chrome downloads one, users need to select Relaunch for the updated browser to take effect. On Android, users can check Google Play for Chrome’s update and find the installed version in Chrome’s settings under About Chrome.
Organizations and users on other Chromium-based browsers should follow their browser maker’s security notices and verify the version that vendor identifies as fixed. The next useful developments are confirmation of wider patch availability, updates from vendors that had not yet listed a fix, and any additional technical information Google may release after more users have updated.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit exists in the wild, but has not published the affected code path or details of the exploit.
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, Chrome 157 (157.0.8103.50) for Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
Why is this described as a zero-day?
The source uses the term because Google reported exploitation before the public release of the fix. The release notes say the bug was reported November 6 and the fix shipped November 9; they do not give a fuller timeline of the attacks.
Does the Chrome update cover Edge and other Chromium browsers?
Not automatically. Each browser vendor distributes its own updates. Check that vendor’s release notes and confirm the installed version is listed as fixed.
How can I tell whether Chrome is updated?
On desktop, open Chrome’s menu, select Help, then About Google Chrome. Install any available update and click Relaunch. On Android, check for an update in Google Play and review the version in Chrome’s About settings.
Source: ThorstenMeyerAI.com
