A critical zero-day flaw in Google Chromium—tracked as CVE-2026-125350—is under active exploitation, according to a new advisory from CISA. Affected components include the XML parser used by Chromium, a vulnerability that could allow remote attackers to run arbitrary code merely by luring someone to a specially crafted web page. The issue affects multiple browsers derived from Chromium, including Chrome, Edge, and Opera.
What’s going on
CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10, 2026. The bug is a use-after-free error—a memory safety flaw—situated in Chromium’s XML processing module. Such issues occur when code continues to use memory that’s been freed, which can lead to crashes or worse: executing malicious code. Once part of the KEV catalog, it signals the flaw is being used in real-world attacks already.
Google shipped a patch on November 9, 2026. The updated versions are Chrome 157.0.8103.50/51 for Windows and macOS, and 157.0.8103.50 for Linux. Users should verify their browser shows version 157.0.8103.50 or higher. Extended Stable track users are advised to move to version 156.0.8078.96 or above. The flaw was publicly disclosed just three days before the patch, after being reported by an anonymous researcher.
Scope, impact, and what to do
Because the weakness lies within Chromium, it poses a danger to any browser built atop its codebase—not just Google Chrome. Microsoft Edge, Opera, Brave, Vivaldi, and similar browsers could theoretically be vulnerable until each vendor issues its own patch. At present, there’s no confirmed evidence that attackers are exploiting it to break out of the browser sandbox—but that’s often the next step in chain exploits.
Users are urged to update immediately. For Chrome users, open Settings → About Chrome and allow the update to complete, then restart the browser so the patch takes effect. Users of other Chromium-based browsers should follow their vendor’s guidance and apply updates as soon as available. Administrators should ensure that all managed devices are updated and rebooted where needed.
This CVE is now the eighth Chrome zero-day exploited this year added to KEV. Memory safety bugs continue to be a dominant source of critical browser vulnerabilities—in Chrome’s case, around 70 % of serious security issues are related to memory misuse. It’s a consistent reminder that secure coding and robust memory management remain essential in browser development.
Why this matters: Browsers serve as a key gateway between users and the Internet. A zero-day exploit that allows code execution from just viewing a web page elevates the risk dramatically. The quick turnaround—just three days from report to patch—shows this was considered a serious threat. For businesses and individuals alike, it’s a test of response: installs and restarts must be prompt to stay ahead of attackers.
