unpatched/intel
Latest briefing
Patch nowExploitedKEVhighExploited Vulnerabilities

Google Chrome XML flaw exploited to execute arbitrary code via CVE-2026-125350

By Harith Dilshan2 min read

TL;DR

Google has released a patch for CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component that is currently being exploited in the wild. All Chrome users must update their browsers immediately to prevent potential arbitrary code execution.

What happened

On Monday, Google released updates addressing nine security vulnerabilities. The most critical is CVE-2026-125350, a use-after-free bug located in the XML component. An anonymous researcher discovered and reported the flaw on November 6, 2026.

Google confirmed that an exploit for this vulnerability exists and is being used in real-world attacks. This marks the eighth Chrome zero-day exploited in 2026, following previous vulnerabilities including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

Why it matters

Use-after-free vulnerabilities occur when a program tries to access memory after it has been freed, which can lead to program crashes, data corruption, or arbitrary code execution. Because an exploit is already active in the wild, attackers can target users by tricking them into visiting malicious sites or processing crafted files. This is a high-priority fix for anyone running a Chromium-based browser.

Who is affected

  • Google Chrome for Windows (versions 157.0.8103.50/.51)
  • Google Chrome for Apple macOS (versions 157.0.8103.50/.51)
  • Google Chrome for Linux (version 157.0.8103.50)
  • Other Chromium-based browsers (including Microsoft Edge, Brave, Opera, and Vivaldi)

What to do now

  1. Update Google Chrome to version 157.0.8103.50/.51 for Windows and macOS, or 157.0.8103.50 for Linux.
  2. Relaunch the browser by navigating to More > Help > About Google Chrome to ensure the update is applied.
  3. Apply updates to all other Chromium-based browsers as soon as their respective patches are released.

What we don't know yet

  • The specific methods used to abuse the exploit in real-world attacks.
  • The identity of the threat actors performing the exploitation.
  • Whether this bug exists in a third-party library used by other software projects.

Sources

  1. thehackernews.comhttps://thehackernews.com/2026/11/google-issues-chrome-security-update.html

Offensive security engineer, ethical hacker and penetration tester. Writes Unpatched Intel from h4rithd.com.

Patch nowExploitedhighExploited VulnerabilitiesNew

Critical Zero-Day in Chrome Exploited: Immediate Browser Updates Urged

Google has patched a critical zero-day vulnerability in Chrome (CVE-2026-11645) that allowed attackers to execute arbitrary code within the browser's sandbox. This flaw was exploited before version 149.0.7827.103 of Chrome, and it underscores the importance of timely updates for users. The anonymous researcher who reported this bug received a $55,000 reward. Defenders should prioritize updating their browsers immediately to mitigate any risks.

CVE-2026-116454 min
Patch nowhighExploited VulnerabilitiesNew

Public exploits for Firefox critical vulnerabilities drive urgent browser security updates

Mozilla has released patches for two critical Firefox vulnerabilities that already have public exploit code available. While no active attacks in the wild have been confirmed, defenders should update their browsers immediately to mitigate risk. Google has also issued a significant update for Chrome to address 15 total vulnerabilities, including several high-severity flaws.

2 min
Patch nowExploitedKEVhighAPT / Nation-StateNew

APT29 deploys mobile exploit kits via hijacked analytics and watering holes

APT29-linked actors are using hacked websites, lookalike proxy domains and a hijacked analytics script to push mobile exploit chains to iOS and Android users. The zero-click browser exploits steal cookies, passwords and, on iOS 18.5, full device data. Every flaw in the chains is already patched, so update iOS, Android and Chrome now.

CVE-2025-43529CVE-2026-3910CVE-2026-207002 min