Google said it “is aware that an exploit for CVE-2026-125350 exists in the wild”; the high-severity use-after-free in Chrome’s XML component is fixed in version 157, which will roll out over the coming days and weeks.
Google on Monday released Chrome security updates fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free flaw in the browser’s XML component, reported by an anonymous researcher on 6 November. Google said it “is aware that an exploit for CVE-2026-125350 exists in the wild.” The company has not described the attacks or who is behind them. The fix is in Chrome 157.0.8103.50 and .51 for Windows and Mac and 157.0.8103.50 for Linux, and Google said the update “will roll out over the coming days/weeks.” SecurityWeek counts it as the eighth exploited Chrome zero-day this year. As of SecurityWeek’s report early Tuesday, CISA had not added it to its Known Exploited Vulnerabilities catalog.
Sources: Google Chrome Releases · SecurityWeek