Title: Google Patches Actively Exploited Chrome XML Use-After-Free (CVE-2026-125350)
Summary: Google updated the Chrome stable channel on Monday, November 9, 2026, to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, with rollout over the coming days/weeks. Among the nine vulnerabilities fixed in the update per The Hacker News is CVE-2026-125350, a use-after-free in the XML component rated High by Google and reported by an anonymous researcher on 2026-11-06 (Chromium issue 582442907) — the only one of the nine that Google’s release note links to a known in-the-wild exploit. Google states in the note that it is aware “that an exploit for CVE-2026-125350 exists in the wild,” without describing the attacks or the actors behind them; per The Hacker News this is the eighth actively exploited Chrome zero-day patched so far in 2026. As usual, bug details may stay restricted until most users are updated. Users should install the update via More → Help → About Google Chrome and relaunch; users of other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply the same fixes as their vendors ship them.
References: