Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-476799c76cEarly warningVulnerabilityConfirmed

Google patches Chrome XML zero-day reported as exploited in attacks

SecurityWeek reports that Chrome has a high-severity use-after-free flaw in its XML component, which was reported anonymously on November 6. According to the item, the flaw is already being exploited in attacks, and an update patches it.

Written by a model from the sources below. Verify against them.

Sources21Confirmed
Kind
Vulnerability
Vendor
Google
Product
Chrome
Status
Confirmed
First seen
Confirmed

What to do

  • Update Chrome to the latest version now.

  • Restart the browser after updating to apply the fix.

  • Check Chrome's version at chrome://settings/help and confirm it is current.

  • Check the installed version under Settings > About Chrome

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now1 day
  3. Confirmed as CVE-2026-125350
  4. Record last updated

Evidence 21

  1. Social
    Mastodon
    “Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.”
    +42 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  2. Social
    Mastodon
    “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
  3. Social
    Bluesky
    “Google fixes Chrome zero-day CVE-2026-125350, exploited in the wild, plus 8 more flaws.”
    +31 more: Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky, Bluesky
  4. Social
    Mastodon
    “Google fixes Chrome zero-day CVE-2026-125350, exploited in the wild, plus 8 more flaws.”
    +3 more: Mastodon, Mastodon, Mastodon
  5. Social
    Mastodon
    “Google says attackers are exploiting a flaw in Chrome”
Show all 21 sourcesShow fewer sources
  1. Social
    Mastodon
    “Google confirms a Chrome XML use-after-free is being exploited in the wild.”
    +2 more: Mastodon, Mastodon
  2. Press
    SecurityWeek
    “The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.”
  3. Social
    Bluesky
    “An exploited zero-day in Chrome's XML component is fixed.”
    +2 more: Bluesky, Bluesky
  4. Social
    Bluesky
    “Google has released an urgent security update for its Chrome browser, addressing nine vulnerabilities, including a high-severity zero-day flaw that the company confirms is already…”
    +1 more: Bluesky
  5. Press
    The Hacker News
    “Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.”
  6. Social
    Bluesky
    “Google publie une MAJ Chrome corrigeant neuf failles, dont une zero-day activement exploitée (CVE-2026-125350) : use-after-free dans le composant XML.”
  7. Social
    Bluesky
    “Google patches nine Chrome flaws, including actively exploited CVE-2026-125350, a high-severity use-after-free vulnerability in the XML component.”
  8. Press
    BleepingComputer
    “Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.”
    +1 more: BleepingComputer on Bluesky
  9. Social
    Mastodon
    “The flaw, known as CVE-2026-125350, was found in Chrome's XML component and is already being exploited in the wild.”
  10. Social
    Mastodon
    “https:// gbhackers.com/google-chrome-ze ro-day-vulnerability-2/amp # ZeroDay # ChromeSecurity # CyberSecurity # Vulnerability # InfoSec # PatchedOrPerish (3/3)”
  11. Social
    Bluesky
    “Google thumps one down with a shiny new update, and another pops up through a ho...”
  12. Social
    Mastodon
    “Google’s Nov. 9 Chrome update fixes CVE-2026-125350, a high-severity XML flaw.”
    +1 more: Mastodon
  13. Social
    Mastodon
    “Google stopft eine Lücke in Chrome.”
  14. Social
    Mastodon
    “l'une d'elles est une vulnérabilité zero-day avec un exploit qui existe dans la nature.”
  15. Social
    Bluesky
    “Chrome fixed an exploited XML bug in 157.0.8103.50.”
  16. Social
    r/cybersecurity
    “Google patches Chrome zero-day already exploited in attacks”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-476799c76c

Has Google confirmed it?

Mastodon, Mastodon and Bluesky report a possible compromise. None of the sources says it happened.Source: Mastodon, Mastodon, Bluesky, Mastodon, Mastodon, Mastodon, SecurityWeek, Bluesky, Bluesky, The Hacker News, Bluesky, Bluesky, BleepingComputer, Mastodon, Mastodon, Bluesky, Mastodon, Mastodon, Mastodon, Bluesky, r/cybersecurity

What should Google users do?

Update Chrome to the latest version now. Restart the browser after updating to apply the fix. Check Chrome's version at chrome://settings/help and confirm it is current. Check the installed version under Settings > About Chrome.

Does it have a CVE?

Yes. It is tracked as CVE-2026-125350.Source: CVE-2026-125350

Sources

Tracked as