MALWAREBYTES
Update Chrome now to fix a flaw attackers are exploiting
HIGH Chrome zero-day actively exploited use-after-free
Strategic summary
Google released a security update for Chrome on November 9. The update fixes nine vulnerabilities, including an actively exploited zero-day tracked as CVE-2026-125350. This vulnerability is a high severity use-after-free flaw in Chrome's XML component. Users should update Chrome manually via About Google Chrome or check Google Play on Android.
Key findings
- Google updated Chrome Stable to versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux.
- The update addresses nine security issues, including the actively exploited zero-day vulnerability CVE-2026-125350.
- CVE-2026-125350 is a high severity use-after-free flaw in Chrome's XML component.
- HKCERT rates the overall risk as extremely high; possible impacts include denial of service, security restriction bypass, and remote code execution.
- Users should update Chrome manually via About Google Chrome; Android users should check Google Play for the update.
Relevance for you
This is an already actively exploited Chrome zero-day that Google closed with an unscheduled Stable update after third-party notification on 6 November , manual updating is needed since rollout can take weeks.
Risk score
17
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 15.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -3.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
TTP_SKIPPEDTTP mapping skipped (placeholder or aggregation article) −3
- Consensus penalty:
- −3.0
- Total penalty:
- −3.0