Chrome 157 Patches XML Use-After-Free With an Exploit in the Wild
Security / news
Chrome 157 Patches XML Use-After-Free With an Exploit in the Wild
CVE-2026-125350 is the eighth Chrome zero-day of 2026, and the credit line shows two reports of the bug 25 days apart.
Chrome 157.0.8103.50 fixes CVE-2026-125350, a use-after-free in Chrome's XML component that Google says already has an exploit in the wild. A remote attacker needs a victim to open a crafted webpage, and per CISA's description the resulting code execution happens inside the browser sandbox, so a second bug would be needed to escape it.
Google published the update on Monday, November 9. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10 with a November 24 due date for federal agencies.
What Google's release post says
The Chrome Releases post lists 157.0.8103.50 or .51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out "over the coming days/weeks." The update carries 9 security fixes. The post lists eight of them: six rated High, including the exploited one, and two rated Medium.
Google's statement is one sentence: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." The post gives no description of who is exploiting it, against whom, or whether the exploit chains with a sandbox escape. Google also notes that bug details may stay restricted until most users have updated.
CISA's entry adds a scoping detail Google's post does not: the flaw is in Chromium, so Microsoft Edge and Opera are named as potentially affected alongside Chrome.
Two reports, 25 days apart
The credit line for CVE-2026-125350 is unusual. It reads "Reported by Arni Hardarson (Neonix Security) on 2026-10-12 and anonymous on 2026-11-06" and lists two bug tracker IDs. SecurityWeek and other outlets describe the bug as reported anonymously on November 6.
Google's post does not say which report corresponds to the exploit it knows about. If the October 12 report is the same bug, Chrome had a researcher's report for 28 days before the patched build shipped on November 9. If it is a related bug, the gap is 3 days. The post does not settle it.
| CVE | Severity | Component | Reported |
|---|---|---|---|
| CVE-2026-125350 | High | XML (use after free) | 2026-10-12 and 2026-11-06 |
| CVE-2026-125344 | High | V8 (type confusion) | 2026-10-02 |
| CVE-2026-125348 | High | GPU (out of bounds write) | 2026-09-18 |
| CVE-2026-125347 | High | FileSystem (incorrect authorization) | 2026-09-15 |
| CVE-2026-125343 | High | Compositing (buffer overflow) | 2026-09-15 |
| CVE-2026-125345 | High | WebGL (uninitialized resource) | 2026-08-21 |
The eighth Chrome zero-day of 2026
BleepingComputer counts this as the eighth Chrome zero-day exploited in 2026 and lists the others. V8, Chrome's JavaScript engine, accounts for four of the eight. The XML component is a first.
- V84 bugs
- Skia1 bugs
- Dawn1 bugs
- CSS font features1 bugs
- XML1 bugs
Source: BleepingComputer, November 10, 2026; accessed 2026-11-12
The four V8 bugs are CVE-2026-3910 in March, CVE-2026-11645 in June, and CVE-2026-87491 and CVE-2026-85046 in September.
What to do
Open chrome://settings/help and relaunch until the version reads 157.0.8103.50 or later. Edge and Opera users should check their vendors' release notes, since CISA says the Chromium bug can affect them; this article did not fetch either vendor's advisory, so their patched versions are not given here.
Google has not said whether a second flaw is paired with this one. The same build fixes the five other High-rated bugs in the table. The Terminal has also covered Apache httpd 2.4.71's mod_http2 flaw and an agentic pentest framework's intrusion reports. Administrators who push browser updates by policy have until November 24 to meet CISA's date.
Sources
More in Security
- 01FreeSWITCH 1.11.3 Fixes a SIP MESSAGE Flaw Already Used in AttacksOne accepted chat message lets a peer pick which FreeSWITCH API command the server runs, and the default config leaves chat switched on.
- 02A 2022 Samsung TV Still Trusted a Compromised eMudhra Certificate, and Its Owner Used That to Swap the AdsDaniel Vrátil replaced Smart Hub banner ads with family photos by signing a certificate with a key the industry had already distrusted.
- 03PostgreSQL 18.7 Fixes CVE-2026-6460, a Type Confusion That a Researcher Turned Into Code ExecutionThe project's advisory says an object creator is needed. The researcher says the lowest-privileged login role is enough.
- 04Exploited Outlook Spoofing Bug CVE-2026-124194 Sends Credentials to an Attacker's Server, and Qualys Prints Two TotalsOpening a crafted message file can make Outlook connect to an attacker-controlled location without the usual warning.