Google Chrome Patches Eighth Zero-day Vulnerability of the Year (CVE-2026-125350)

Google released security updates to address nine vulnerabilities impacting the Chrome browser. One of these vulnerabilities, tracked as CVE-2026-125350, is being exploited in the wild. This is a use-after-free flaw affecting the XML component. A use-after-free flaw occurs when software continues to reference or manipulate memory after it has been freed. Successful exploitation may allow attackers to corrupt data, cause system instability, or execute arbitrary code.

CISA acknowledged the active exploitation of the vulnerability by adding it to its Known Exploited Vulnerabilities Catalog. CISA urges users to patch the vulnerability before November 24, 2026.

CVE-2026-125350 is the eighth zero-day vulnerability patched by Google since the start of the year. The list includes:

1. CVE-2026-2441
2. CVE-2026-3909
3. CVE-2026-3910
4. CVE-2026-5281
5. CVE-2026-11645
6. CVE-2026-85046
7. CVE-2026-87491

Google addressed eight other vulnerabilities with the zero-day. The list includes:

• CVE-2026-125345: An uninitialized resource flaw in WebGL.
• CVE-2026-125347: An incorrect authorization flaw in FileSystem.
• CVE-2026-125343: A buffer overflow flaw in Compositing.
• CVE-2026-125348: An out-of-bounds write flaw in GPU.
• CVE-2026-125344: A type confusion flaw in V8.
• CVE-2026-125346: A use-after-free in XML.
• CVE-2026-125349: An uninitialized resource flaw in GPU.
• CVE-2026-125342: An uninitialized resource flaw in GPU.

Affected Versions

The vulnerability affects Google Chrome versions before 157.0.8103.50.

Mitigation

Customers must upgrade to the stable channel version 57.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 to Linux, which will roll out over the coming days/weeks.

For more information, please refer to the Google Chrome Release Page.

Qualys Detection

Qualys customers can scan their devices with QID 389337 to detect vulnerable assets.

Rapid Response with TruRisk™ Eliminate

Qualys TruRisk Eliminate and its Zero-Touch Patching feature provide a seamless, automated process for patching vulnerabilities like this.

Zero-Touch Patching identifies the most vulnerable products in your environment and automates the deployment of necessary patches and configuration adjustments. This streamlines the patching process and ensures vulnerabilities are addressed promptly.

Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.

References
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html