NEWS

Chrome 157 Patches Exploited XML Zero-Day, the Eighth of 2026

Google fixed CVE-2026-125350, a high-severity use-after-free in Chrome's XML component that is already exploited in the wild. Update to 157.0.8103.50.

Dylan H.

News Desk

November 10, 2026
2 min read
Chrome 157 Patches Exploited XML Zero-Day, the Eighth of 2026

Overview

Google has released Chrome 157 updates that fix CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component. Google says the flaw is being exploited in the wild, making it the eighth Chrome zero-day exploited in 2026, according to SecurityWeek.

Details

  • Reporter: an anonymous researcher, who reported the bug on November 6
  • Class: use-after-free (memory corruption), which can lead to arbitrary code execution in the renderer when triggered by crafted content
  • Exploitation: confirmed in attacks. Google has not published details about the campaigns or targets.
  • KEV status: at the time of reporting, CISA had not yet added it to the Known Exploited Vulnerabilities catalog

Fixed Versions

PlatformVersion
Windows157.0.8103.50 / 157.0.8103.51
macOS157.0.8103.50 / 157.0.8103.51
Linux157.0.8103.50

Other Fixes in the Release

The update also patches six other high-severity bugs in WebGL, FileSystem, Compositing, GPU, V8 and XML, most found internally by Google, plus two medium-severity uninitialized resource issues in the GPU component.

Recommended Actions

  1. Update Chrome now and restart the browser. Check chrome://settings/help to confirm version 157.0.8103.50 or later.
  2. Update other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as vendors ship the fix.
  3. Enterprise: push the update through your management tooling and verify fleet version compliance.
  4. Watch for CISA KEV inclusion, which would set a federal remediation deadline.

Sources