Covered by 4 outlets — first reported by SecurityWeek, Nov 10, 06:12 UTC
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
MentionsGoogleGoogle Chrome
Summary
Google released Chrome updates on Monday that fix nine security vulnerabilities, including one it says is already being exploited in attacks. The exploited flaw, CVE-2026-125350, is a high-severity use-after-free bug (a memory-handling error) in Chrome's XML component and was reported anonymously on November 6. Security Affairs also links it to the V8 engine, while the other outlets place it in XML. It is the eighth Chrome zero-day, a flaw exploited before a fix existed, patched this year.
AI summary by the SecurityTabs newsroom, checked against SecurityWeek, The Hacker News, BleepingComputer, Security Affairs. Read the outlets below for the full story.
Continue reading
4 outlets, in the order they reported it.
SecurityWeekFirst report
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.
The Hacker News
Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.
BleepingComputer
Google patches eighth Chrome zero-day exploited in attacks this year
Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year.
Security Affairs
Google fixes the eighth actively exploited Chrome zero-day of 2026
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.