# SZB-476799c76c: Google patches Chrome XML zero-day reported as exploited in attacks

SecurityWeek reports that Chrome has a high-severity use-after-free flaw in its XML component, which was reported anonymously on November 6. According to the item, the flaw is already being exploited in attacks, and an update patches it.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Google
- Product: Chrome
- Status: Confirmed
- Sources: 21 distinct
- First seen: 2026-11-09 20:02 UTC
- Confirmed: 2026-11-10 07:14 UTC

Written by a model from the sources below. Verify against them.

## What to do

- Update Chrome to the latest version now.
- Restart the browser after updating to apply the fix.
- Check Chrome's version at chrome://settings/help and confirm it is current.
- Check the installed version under Settings \> About Chrome

## Timeline

- 2026-11-09 20:01 UTC: Made public by Mastodon
- 2026-11-09 20:02 UTC: First seen by cve.now
- 2026-11-10 07:14 UTC: Confirmed as CVE-2026-125350
- 2026-11-10 21:16 UTC: Record last updated

## Evidence (21 sources)

- 2026-11-09 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117588260810945038): “Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.” (+43 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117588260877390990), [Mastodon](https://mastodon.social/@EUVD_Bot/117588260933847240), [Mastodon](https://mastodon.social/@EUVD_Bot/117588260983126775), [Mastodon](https://mastodon.social/@EUVD_Bot/117588261042526741), [Mastodon](https://mastodon.social/@EUVD_Bot/117588496647682043), [Mastodon](https://mastodon.social/@EUVD_Bot/117588496711024800), [Mastodon](https://mastodon.social/@EUVD_Bot/117588496782005109), [Mastodon](https://mastodon.social/@EUVD_Bot/117588496856331415), [Mastodon](https://mastodon.social/@EUVD_Bot/117588496881423567), [Mastodon](https://mastodon.social/@EUVD_Bot/117588500873688850), [Mastodon](https://mastodon.social/@EUVD_Bot/117588500905633323), [Mastodon](https://mastodon.social/@EUVD_Bot/117588500950419471), [Mastodon](https://mastodon.social/@EUVD_Bot/117588504466101131), [Mastodon](https://mastodon.social/@EUVD_Bot/117588504538133172), [Mastodon](https://mastodon.social/@EUVD_Bot/117588504571796330), [Mastodon](https://mastodon.social/@EUVD_Bot/117588504627899411), [Mastodon](https://mastodon.social/@EUVD_Bot/117588504712081583), [Mastodon](https://mastodon.social/@EUVD_Bot/117588504747844584), [Mastodon](https://mastodon.social/@EUVD_Bot/117588508445468601), [Mastodon](https://mastodon.social/@EUVD_Bot/117588508541964081), [Mastodon](https://mastodon.social/@EUVD_Bot/117588508572527494), [Mastodon](https://mastodon.social/@EUVD_Bot/117588508602081503), [Mastodon](https://mastodon.social/@EUVD_Bot/117588508701186488), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512375421159), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512408277833), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512470503343), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512601928309), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512636930439), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512665437340), [Mastodon](https://mastodon.social/@EUVD_Bot/117588512693376244), [Mastodon](https://mastodon.social/@EUVD_Bot/117592743603941570), [Mastodon](https://mastodon.social/@EUVD_Bot/117592747365670122), [Mastodon](https://mastodon.social/@EUVD_Bot/117592747421753403), [Mastodon](https://mastodon.social/@EUVD_Bot/117592747465764594), [Mastodon](https://mastodon.social/@EUVD_Bot/117593455296374357), [Mastodon](https://mastodon.social/@EUVD_Bot/117593455422089935), [Mastodon](https://mastodon.social/@EUVD_Bot/117593455450013306), [Mastodon](https://mastodon.social/@EUVD_Bot/117593455486412880), [Mastodon](https://mastodon.social/@EUVD_Bot/117593455526808634), [Mastodon](https://mastodon.social/@EUVD_Bot/117593459049567623), [Mastodon](https://mastodon.social/@EUVD_Bot/117593459097528535), [Mastodon](https://mastodon.social/@EUVD_Bot/117593459155083835), [Mastodon](https://mastodon.social/@ninjaintelgroup/117594214991121147))
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@ssvc/117588962354641958): “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
- 2026-11-09 · Social · [Bluesky](https://bsky.app/profile/securityonline.bsky.social/post/3mzw3ttqnou2t): “Google fixes Chrome zero-day CVE-2026-125350, exploited in the wild, plus 8 more flaws.” (+31 more: [Bluesky](https://bsky.app/profile/thedailytechfeed.com/post/3mzwm2la2tc2w), [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/2zptbpw2buvpl), [Bluesky](https://bsky.app/profile/ifynxstudio.bsky.social/post/7thobegs4zvey), [Bluesky](https://bsky.app/profile/aman179102.bsky.social/post/3mzwzqr3dwd24), [Bluesky](https://bsky.app/profile/cybermaster77.bsky.social/post/3mzx3azfmqc2y), [Bluesky](https://bsky.app/profile/newssecia.bsky.social/post/3mzx536gusj2c), [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/6wcw6gk7nv7i3), [Bluesky](https://bsky.app/profile/malice.ai/post/3mzx6l2kmermw), [Bluesky](https://bsky.app/profile/e-kiledjian.bsky.social/post/3mzx6sd2ije2p), [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzx7ghl7q22d), [Bluesky](https://bsky.app/profile/blockchainreport.bsky.social/post/3mzxa4dgk4u2m), [Bluesky](https://bsky.app/profile/neroqc.bsky.social/post/3mzxbrk7ybp2b), [Bluesky](https://bsky.app/profile/talkwithtech.bsky.social/post/3mzxc35odmg2u), [Bluesky](https://bsky.app/profile/crustytldr.bsky.social/post/3mzxc5cjfiv2j), [Bluesky](https://bsky.app/profile/yasna.io/post/3mzxd3mrfqc22), [Bluesky](https://bsky.app/profile/1lpl.bsky.social/post/3mzxdebg7ls2y), [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzxdjrrdoc2u), [Bluesky](https://bsky.app/profile/rasnedev.bsky.social/post/3mzxewqejyb2v), [Bluesky](https://bsky.app/profile/tierrasapiens.bsky.social/post/3mzxiexx6sk2l), [Bluesky](https://bsky.app/profile/buhane.com.tr/post/3mzxmuxbqbt2h), [Bluesky](https://bsky.app/profile/netsecio.bsky.social/post/3mzxo54ht222q), [Bluesky](https://bsky.app/profile/patrickcmiller.bsky.social/post/3mzxoeiuirc2a), [Bluesky](https://bsky.app/profile/sergioiker.bsky.social/post/3mzxoijelh22o), [Bluesky](https://bsky.app/profile/thelabledger.bsky.social/post/3mzxptxrum22t), [Bluesky](https://bsky.app/profile/techhelpkb.bsky.social/post/3mzxqbjxfes2c), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzxs4kcqbr26), [Bluesky](https://bsky.app/profile/ninjaowl.ai/post/3mzxwtplxkq2s), [Bluesky](https://bsky.app/profile/hack4career.com/post/3mzy454j2gr2r), [Bluesky](https://bsky.app/profile/teckhustlers.bsky.social/post/3mzy4adb3pw2f), [Bluesky](https://bsky.app/profile/clouddoctrine.bsky.social/post/3mzy6ctfl4c24), [Bluesky](https://bsky.app/profile/earthnewstrending.bsky.social/post/3mzydk75kkv26))
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117589114037462990): “Google fixes Chrome zero-day CVE-2026-125350, exploited in the wild, plus 8 more flaws.” (+3 more: [Mastodon](https://manganiello.tech/@nemo/117591525653215045), [Mastodon](https://infosec.exchange/@threataft/117592868546566495), [Mastodon](https://mastodon.social/@threataft/117592868832432061))
- 2026-11-09 · Social · [Mastodon](https://infosec.exchange/@patchsonar/117589161724533957): “Google says attackers are exploiting a flaw in Chrome”
- 2026-11-10 · Social · [Mastodon](https://mastodon.social/@threadlinqs/117590296304773366): “Google confirms a Chrome XML use-after-free is being exploited in the wild.” (+2 more: [Mastodon](https://mastodon.social/@Analyst207/117591063987085276), [Mastodon](https://mastodon.social/@Analyst207/117592481274844950))
- 2026-11-10 · Press · [SecurityWeek](https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/): “The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/veduis.bsky.social/post/3mzwsb3aqnr2j): “An exploited zero-day in Chrome's XML component is fixed.” (+2 more: [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzwtsszeac2s), [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mzx3ghug4n2i))
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzwsoozym22g): “Google has released an urgent security update for its Chrome browser, addressing nine vulnerabilities, including a high-severity zero-day flaw that the company confirms is already…” (+1 more: [Bluesky](https://bsky.app/profile/cybernewsph.com/post/3mzwtkbgxnv25))
- 2026-11-10 · Press · [The Hacker News](https://thehackernews.com/2026/11/google-issues-chrome-security-update.html): “Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/calimegai.bsky.social/post/3mzwwdkcej225): “Google publie une MAJ Chrome corrigeant neuf failles, dont une zero-day activement exploitée (CVE-2026-125350) : use-after-free dans le composant XML.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/technology-news.bsky.social/post/3mzx26s7na22l): “Google patches nine Chrome flaws, including actively exploited CVE-2026-125350, a high-severity use-after-free vulnerability in the XML component.”
- 2026-11-10 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/): “Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzx2wlsy3g2w))
- 2026-11-10 · Social · [Mastodon](https://mastodon.social/@Analyst207/117591299529876653): “The flaw, known as CVE-2026-125350, was found in Chrome's XML component and is already being exploited in the wild.”
- 2026-11-10 · Social · [Mastodon](https://infosec.exchange/@security_crawler_carl/117591774085913967): “https:// gbhackers.com/google-chrome-ze ro-day-vulnerability-2/amp # ZeroDay # ChromeSecurity # CyberSecurity # Vulnerability # InfoSec # PatchedOrPerish (3/3)”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/j4vv4d.com/post/3mzxhnpaawk25): “Google thumps one down with a shiny new update, and another pops up through a ho...”
- 2026-11-10 · Social · [Mastodon](https://twit.social/@RobCampbell/117592668168476056): “Google’s Nov. 9 Chrome update fixes CVE-2026-125350, a high-severity XML flaw.” (+1 more: [Mastodon](https://infosec.exchange/@cyberseckyle/117592881839748268))
- 2026-11-10 · Social · [Mastodon](https://squeet.me/display/962c3e10-7e97adaf-096d8227d2c5de1c): “Google stopft eine Lücke in Chrome.”
- 2026-11-10 · Social · [Mastodon](https://mastobot.ping.moi/@cyberveille/117593565218056274): “l'une d'elles est une vulnérabilité zero-day avec un exploit qui existe dans la nature.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/proxymint.com/post/3mzy3yaowur2n): “Chrome fixed an exploited XML bug in 157.0.8103.50.”
- 2026-11-10 · Social · [r/cybersecurity](https://www.reddit.com/r/cybersecurity/comments/1xsvy9p/google_patches_chrome_zeroday_already_exploited/): “Google patches Chrome zero-day already exploited in attacks”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-476799c76c&body=https%3A%2F%2Fcve.now%2FSZB-476799c76c%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-476799c76c

### Has Google confirmed it?

Mastodon, Mastodon and Bluesky report a possible compromise. None of the sources says it happened.

Source: https://mastodon.social/@EUVD_Bot/117588260810945038, https://infosec.exchange/@ssvc/117588962354641958, https://bsky.app/profile/securityonline.bsky.social/post/3mzw3ttqnou2t, https://infosec.exchange/@DailyCyberSecurity/117589114037462990, https://infosec.exchange/@patchsonar/117589161724533957, https://mastodon.social/@threadlinqs/117590296304773366, https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/, https://bsky.app/profile/veduis.bsky.social/post/3mzwsb3aqnr2j, https://bsky.app/profile/undercodenews.bsky.social/post/3mzwsoozym22g, https://thehackernews.com/2026/11/google-issues-chrome-security-update.html, https://bsky.app/profile/calimegai.bsky.social/post/3mzwwdkcej225, https://bsky.app/profile/technology-news.bsky.social/post/3mzx26s7na22l, https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/, https://mastodon.social/@Analyst207/117591299529876653, https://infosec.exchange/@security_crawler_carl/117591774085913967, https://bsky.app/profile/j4vv4d.com/post/3mzxhnpaawk25, https://twit.social/@RobCampbell/117592668168476056, https://squeet.me/display/962c3e10-7e97adaf-096d8227d2c5de1c, https://mastobot.ping.moi/@cyberveille/117593565218056274, https://bsky.app/profile/proxymint.com/post/3mzy3yaowur2n, https://www.reddit.com/r/cybersecurity/comments/1xsvy9p/google_patches_chrome_zeroday_already_exploited/

### What should Google users do?

Update Chrome to the latest version now. Restart the browser after updating to apply the fix. Check Chrome's version at chrome://settings/help and confirm it is current. Check the installed version under Settings > About Chrome.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-125350.

Source: https://cve.now/CVE-2026-125350

## Tracked as

- [CVE-2026-125350](https://cve.now/CVE-2026-125350.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-476799c76c
Site guide for agents: https://cve.now/llms.txt