Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Google has rolled out an emergency security patch for a high-severity desktop Chrome vulnerability tracked as CVE-2026-125350, which the company confirmed has already been exploited in the wild. The update brings Chrome to version 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. According to SecurityWeek, the vulnerability was submitted anonymously on November 6. [1][2]
The bug involves a use-after-free weakness within Chrome's XML component. Google explained that when the browser's XML parser processes data, it deletes an object from system memory but fails to clear the pointer referencing it. Attackers can exploit this memory corruption defect when the browser attempts to access that freed memory, potentially allowing them to manipulate the layout and execute malicious code. Google is keeping detailed technical access restricted until a majority of users update. [1][2]
The fix marks the eighth actively exploited Chrome zero-day vulnerability patched by Google since the start of the year, following earlier zero-day remediations involving CSS, graphics, WebGPU, and the V8 JavaScript engine. [1]
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
via BleepingComputerThe high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.
via SecurityWeek