Chrome 157 Fixes CVE-2026-125350, the Eighth Exploited Zero-Day of 2026
Security / news
Chrome 157 Fixes CVE-2026-125350, the Eighth Exploited Zero-Day of 2026
Google says an exploit for an XML use-after-free exists in the wild. Four of the eight exploited Chrome bugs of 2026 sit in the V8 engine.
A web page that triggers a use-after-free in Chrome's XML component can corrupt memory in the browser, and Google says someone is already doing that. The flaw, CVE-2026-125350, is fixed in Chrome 157.0.8103.50 for Linux and 157.0.8103.50/.51 for Windows and macOS. Google's advisory on Monday, Nov. 9 said "Google is aware that an exploit for CVE-2026-125350 exists in the wild," per BleepingComputer.
The mitigation is to update and restart the browser. Chrome applies the update on relaunch, so a long-running session stays vulnerable until then. Other Chromium browsers need their own builds.
What is known and what is not
SecurityWeek reports that an anonymous researcher reported the bug to Google on Nov. 6, three days before the fix. Google has not said who is exploiting it, how, or against whom. Its notice says access to bug details "may be kept restricted until a majority of users are updated with a fix."
Neither report gives a CVSS score, and neither says whether the bug alone allows escape from Chrome's sandbox. A use-after-free in a renderer component usually needs a second flaw to reach the operating system, but no second flaw has been named here. Both outlets said CISA had not yet added the CVE to its KEV catalog when they published on Nov. 10; check the catalog directly.
The release fixes nine vulnerabilities in total, per SecurityWeek: the zero-day, six more high-severity bugs in WebGL, FileSystem, Compositing, GPU, V8 and XML, and two medium-severity uninitialized-resource issues in GPU. Most were found by Google internally, and no CVE IDs were given for them.
The year's exploited Chrome bugs
BleepingComputer lists every Chrome zero-day patched in 2026 that Google has said was exploited:
| CVE | Component | Fixed |
|---|---|---|
| CVE-2026-2441 | CSSFontFeatureValuesMap | Mid-February |
| CVE-2026-3909 | Skia | March |
| CVE-2026-3910 | V8 | March |
| CVE-2026-5281 | Dawn (WebGPU) | April |
| CVE-2026-11645 | V8 | June |
| CVE-2026-87491 | V8 | September |
| CVE-2026-85046 | V8 | September |
| CVE-2026-125350 | XML | November |
- V84 bugs
- CSS1 bugs
- Skia1 bugs
- Dawn1 bugs
- XML1 bugs
Source: BleepingComputer, Nov. 10, 2026, accessed 2026-11-14
Why V8 dominates the list
Four of eight is the pattern worth noting: the JavaScript engine has produced half of the year's exploited bugs, with two in September alone. XML is a first for this list. The per-component counts are our tally of BleepingComputer's list, not a figure either outlet published.
The timing overlaps with other exploited-flaw news. Microsoft's November patch release included an exploited Outlook spoofing flaw, and CISA's Nov. 9 batch is covered in our piece on the Cisco BroadWorks listing and its peers.
Check chrome://settings/help for version 157.0.8103.50 or later. The next thing to watch is whether CISA adds the CVE to KEV and whether Google discloses the exploitation context once most users have updated.
Sources
More in Security
- 01PyPI's New Security Tab Grades Releases by Attestation, and Says What It Cannot ProveFour provenance states and two history warnings now sit on every project page, while the package managers that would act on them mostly do not check yet.
- 02Citizen Lab Counts 12 Countries Using Penlink's Webloc Ad-Data TrackingAustria's interior ministry joins the US, El Salvador and Hungary, and a Bloomberg investigation adds eight more; Penlink disputed the April findings.
- 03GPUStack Admin Bypass CVE-2026-102895 Is Exploited, and Patching Will Not Remove the AttackerThe loopback check trusts a spoofable header and defaults to off, and intruders left admin API keys and inference backends that survive an upgrade to 2.2.0.
- 04Arara Message Breach Reaches Osaka and Sega, With 77 Million Addresses at RiskA Japanese email-delivery service shut down on October 31 after attackers used it to send 7.13 million phishing emails. Its clients are still counting what leaked.