Abstract:
Google released an emergency security update this week to fix the CVE-2026-125350 vulnerability in the Chrome browser. This vulnerability belongs to the category of zero-day vulnerabilities. Before Google fixed the vulnerability, hackers had already exploited this vulnerability in the wild to launch attacks. Zero-day vulnerabilities are a very bad type of vulnerability for Google, so Google pushes emergency security updates to block the vulnerability.
Use-after-free vulnerability in XML components:
Google security bulletin shows that CVE-2026-125350 is located in the Chrome XML component and is a use-after-free vulnerability. This type of vulnerability usually occurs when a program releases a block of memory and continues to access the memory through old references.
An attacker may take advantage of changes in memory status to cause memory corruption. Such issues, when successfully exploited, could cause the program to crash or execute malicious code. Google confirmed in a security advisory that it has detected an actual exploit based on this vulnerability.
Users should upgrade to the latest version immediately:
Google has fixed the XML zero-day vulnerability through the following version. Google recommends that all users immediately go to the About page to check for updates and upgrade to the new version. If you continue to stay in the old version, you may be attacked due to the vulnerability. As time goes by, the details of exploiting such vulnerabilities may become public, and hackers may use the vulnerabilities to launch attacks.
Chrome for Windows version: 157.0.8103.50 or 157.0.8103.51
Chrome for macOS version: 157.0.8103.50 or 157.0.8103.51
Chrome for Linux version: version 157.0.8103.50
Learn more:
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
Comments