Google fixes nine vulnerabilities in Chrome; CVE-2026-125350 already exploited

Google posted on Monday security updates for the Chrome browser that correct nine vulnerabilities, including a high-severity failure that the company confirms is being actively exploited in real environments. The judgement received as CVE-2026-125350 has been described by Google as a type erroruse-after-freein the XML component of the browser; an anonymous researcher warned about the problem on November 6, 2026 and Google states to be "aware that there is an explosion for CVE-2026-125350 in nature." The Chrome versions that correct the problem are 157.0.8103.50 / .51 for Windows and macOS, and 157.0.8103.50 for Linux. (To update, open More > Help > About Google Chrome and select Reload).

What we know for sure: Google has launched patches that solve nine failures; one of them, CVE-2026-125350, is an after-free user in the code that process XML and is being exploited in nature according to the company itself. The discovery was reported by an anonymous researcher on November 6, 2026 and Google applies the usual practice of restricting technical details until most users have received the arrangement. In addition, the company indicates that this is one more within a series of vulnerabilities exploited in 2026; since the beginning of the year it has mitigated eight cero-days actively exploited, with CVE publicly listed by Google.

What is technically meant by a use-after@-@ free in XML: ause-after-freeIt occurs when the program has already been released to memory; the typical result is unpredictable behavior that can result in crash, data corruption or arbitrary code execution if an attacker is able to control the content of that memory. In this case the failure is within the XML processing, suggesting that plausible vectors include malformed XML documents, web-embedded payloads using XML parsers, or content manipulated by extensions or components that pass XML data to the vulnerable engine. However, Google has not published the exact operating mechanism or samples, so the precise vector used in active attacks is not publicly confirmed.

Practical implications: if an attacker successfully exploits this vulnerability in a non-patching system, it could scale from code execution within the Chrome process to potentially run code with the user's privileges running the browser. At best the result is a process failure and loss of the tab or session; at worst, a compromised equipment, data loss or bridge for other intrusions in the user environment. Since Google has already recognized active exploitation, the risk for users who do not update is immediate.

What's not confirmed: the signature behind the attacks, the campaign scale (number of victims), and the exact delivery vector (e.g., malicious sites vs attachments) have not been disclosed by Google. The company also warns that it will maintain disclosure restrictions if the vulnerability lies in a third-party bookstore that other projects have not yet solved; that external unit, if it exists, has not been publicly specified. Therefore, any statement about the specific attribution or technique used in "nature" would be an estimate for now.

To contrast and follow official ads on patches and technical details, you can check Google's communications on releases and security in the Chrome Releases blog and supporting documentation on how to update the browser: https: / / chromerease.googleblog.com / and https: / / support.google.com / chrome / ansher / 95414. It is also recommended to monitor NVD for future CVE entries: https: / / nvd.nist.gov /.

Specific recommendations for private users: first, update Chrome immediately to the indicated stable version (open More > Help > About Google Chrome and let the browser relance). Check the installed version in chromer: / / version. Second, after updating, restart the system if the installation process requests. Third, activate the automatic update if not enabled and consider activating the enhanced protection in Chrome (Settings > Privacy and Security > Google Services) to get earlier alerts about downloads and dangerous sites. Fourth, limit exposure: avoid downloading or opening unknown XML documents or files and keep extensions to a minimum, reviewing permissions and origin of each.

Recommendations for security managers and teams: display the patch on all managed equipment as soon as possible using your patch management tools and Chrome Enterprise policies. It values the update in test environments before mass deployment, but prioritizes the acceleration of the rollout given the active operating status. Strengthen compensatory controls: apply site isolation (site isolation), unapproved extension blocking policies, and content / IPS locking filters that can detect malicious loads. Check EDR / IDS records to identify suspicious activity in the pre-patch and post-patch days and prepare detection rules for common operating patterns (e.g., unusual XML loads to browser processes).

Finally, remember that the supply chain matters: if your organization uses Chromium-derived browsers (Microsoft Edge, Brave, Opera, Vivaldi, etc.), you must be attentive to the notices and patches that these suppliers publish; sometimes the arrangement comes late with Chrome. Google has explicitly recalled that Chromium-based browsers should also apply corrections when available.

In short, the CVE-2026-125350 failure is a real and present risk - confirmed by Google as exploited -; the immediate defense is to apply the update spread by Chrome and take additional mitigation measures in high-risk environments until telemetry and forensic analysis confirm that there is no infection. Keep in mind official communiqués and the publication of commitment indicators by suppliers and response teams.