By Shar Z, Security Engineer at Nine-Security
On Monday, November 9, 2026, Google shipped a Chrome Stable update that fixes nine security bugs. One of them, CVE-2026-125350, is already being exploited: Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." It is the eighth actively exploited Chrome zero-day fixed this year.
What happened
- CVE-2026-125350 is a high-severity use-after-free in Chrome's XML component, reported anonymously on November 6, 2026. That's only three days from report to patch.
- Google hasn't said who is exploiting it, who's being targeted, or how the exploit is delivered. Bug details stay restricted until most users have updated.
- CyberInsider reports that the public Chromium patch linked to the bug ID points to libxslt, the library Chrome uses for XSLT transformations of XML documents. According to that patch, a nested XML evaluation could free and replace a cached object in libxslt's pattern-matching cache while an earlier operation still held the old memory address.
- As of SecurityWeek's report on November 10, CISA had not yet added it to the KEV catalog.
Fixed versions
- Windows and macOS: 157.0.8103.50/.51
- Linux: 157.0.8103.50
The same release also fixes six other high-severity bugs (another XML use-after-free, CVE-2026-125346; a V8 type confusion; a GPU out-of-bounds write; a Compositing buffer overflow; incorrect authorization in FileSystem; and an uninitialized resource in WebGL), plus two medium-severity GPU issues.
Who's affected
Anyone running Chrome below the fixed versions. Because the root cause appears to be in libxslt, a shared library, other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be watched for their own updates, and software that embeds libxslt deserves a look once upstream details are public. That last part is my inference, not something Google has confirmed.
What to do now
- Update and relaunch. Go to Menu, then Help, then About Google Chrome, let it download, and click Relaunch. A downloaded update doesn't protect a browser that is still running.
-
Enforce it across the fleet. Use Chrome Browser Cloud Management, Intune, or GPO to set a minimum version of 157.0.8103.50 and a forced relaunch deadline (for example, the
RelaunchNotificationandRelaunchNotificationPeriodpolicies). - Find stragglers. Pull browser versions from your EDR or asset inventory and list endpoints still below 157.0.8103.50. Long-running browser sessions are the usual blind spot.
- Track Chromium derivatives. Check Edge, Brave, Opera, and Vivaldi release notes and patch them when the fix lands.
- Hunt quietly. Since Google hasn't published IOCs, look for unusual child processes spawned by browser processes and unexpected browser crashes on high-value users' machines (executives, admins, finance) since early November.
- Watch KEV. If CISA adds the CVE, federal remediation deadlines will follow. Treat it as KEV-grade anyway.
Takeaway
Report on November 6 and patch on November 9 is about as fast as it gets, but the patch only protects you after the browser restarts. Measure your fleet's time-to-relaunch, not just time-to-download.
Sources
- Google Chrome Releases: Stable Channel Update for Desktop (Nov 9, 2026)
- The Hacker News: Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
- BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year
- SecurityWeek: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
- CyberInsider: Google fixes Chrome XML zero-day flaw exploited in attacks
Top comments (0)