Google patches exploited XML zero-day in Chrome 157

Google shipped Chrome 157 on Monday to fix nine security flaws, one of which is CVE-2026-125350, a high-severity use-after-free in the browser's XML code that the company says is being exploited in the wild, according to SecurityWeek. The bug was disclosed to Google on November 6 by an unnamed researcher. Google withheld exploit details, and SecurityWeek says no public description of the attacks exists.

Chrome 157.0.8103.50 and 157.0.8103.51 are the Windows and macOS releases; Linux receives 157.0.8103.50. The U.S. Cybersecurity and Infrastructure Security Agency has not yet added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog.

Six other high-severity issues affect WebGL, FileSystem, Compositing, GPU, V8, and XML, most of them found by Google's own security team, along with two medium-severity uninitialized memory bugs in GPU. With this fix, Google has now patched eight exploited Chrome zero-days in 2026. The prior seven were CVE-2026-87491, CVE-2026-85046, CVE-2026-11645, CVE-2026-5281, CVE-2026-3910, CVE-2026-3909, and CVE-2026-2441, SecurityWeek reported.

Update, November 11, 2026

Pasquale Pillitteri reported on Wednesday that the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on November 10. Federal civilian agencies must install the patched Chrome versions by November 24. The listing follows Google's November 9 fix for the exploited XML use-after-free in Chrome 157.0.8103.50/.51. CISA's addition gives administrators outside the federal government a two-week benchmark, Pillitteri writes.