Chrome Zero Day Strikes Again: Google Fixes an Exploited XML Flaw in Three Days
- Who should care: Every company running Chrome, Edge, Brave, Opera, or Vivaldi on managed laptops.
- What could go wrong: One bad web page, and an attacker can run code on a user’s machine.
- Do this: Push Chrome 157.0.8103.50 or later, then force a relaunch.
- Worth remembering: This Chrome zero-day is the eighth exploited Chrome bug in eleven months. This is now a routine, not a surprise.
Introduction
Google shipped an emergency Chrome update on Monday after confirming attackers were already abusing a new flaw. It’s the eighth Chrome zero-day exploited this year, and the first in the browser’s XML code.
What Happened?
On November 9, Google patched CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. An anonymous researcher reported it on November 6, so the fix landed in three days.
Google says it is aware an exploit exists in the wild but won’t share who is behind the attacks or who got hit. Bug details stay locked until most users update, and longer if the flaw sits in a third-party library other projects haven’t fixed. According to SecurityWeek, the same release fixes eight more bugs, six of them rated high.
What’s the Impact?
Use-after-free bugs let attackers corrupt memory or run their own code from a single booby-trapped page. This Chrome zero-day has no CVSS score or CISA KEV listing yet, so many patch queues won’t flag it. And after four V8 bugs this year, attackers are clearly probing new corners.
The Bigger Picture: A Chrome Zero Day Every Few Months
The seventh Chrome zero-day landed in September. The eighth arrived two months later. Each one affected real people before a patch existed, which means your exposure window starts the moment Google publishes, not when your monthly patch cycle comes around.
How to Avoid This Chrome Zero Day
- Update Chrome to 157.0.8103.50/.51 on Windows and macOS, or 157.0.8103.50 on Linux.
- Force a browser relaunch. Downloaded patches do nothing until Chrome restarts.
- Track Chromium-based browsers separately. Edge, Brave, and Opera ship their own fixes on their own clocks.
- Pull a fleet-wide version report and chase every endpoint still below 157.
- Watch the CISA KEV catalog for listings and federal due dates.
Patching Is Easy. Proving it happened is the Hard Part.
Google did its part in three days. The gap now sits on your side: laptops nobody restarted, browsers nobody tracks, and a clean report nobody can back up.
Secure.com runs Governed Defense, Powered by Offense. AI teammates attack your defenses, harden what they find, and hand your team back hundreds of hours a month.
- Pulls browser versions from the scanners and endpoint tools you already run, so outdated Chrome builds surface fast.
- Ranks fixes by real exploitation evidence, not by whether a flaw has a CVSS score yet.
- Opens the ticket with context attached and tracks it to closure inside your approval rules.
- The Red Teammate retests after the rollout, turning “we patched it” into proof.
- Every action keeps an audit trail. Your team sets the rules. AI teammates do the work.
