Google Fixes 4 Critical Chrome Security Flaws, One Under Active Exploitation
Google has released updates for nine security vulnerabilities in Chrome, including one actively exploited use-after-free flaw in XML.
NEW DELHI, Nov 13: Google released updates to address nine security vulnerabilities in its Chrome browser, including a significant flaw under active exploitation. This high-severity vulnerability, identified as CVE-2026-125350, is a use-after-free bug in the XML component rated at a CVSS score of 8.8.
The issue allows remote attackers to execute arbitrary code within the browser’s sandbox through specially crafted HTML pages, leading to data corruption, program crashes, or unauthorized code execution. An anonymous security researcher reported this flaw on November 6, 2026.
Google confirmed it is aware that the exploit for CVE-2026-125350 is being utilized in real-world attacks but has not disclosed specific details. The company stated, “Access to bug details and links may be kept restricted until a majority of users are updated with a fix.” This shows a cautious approach to handling information about the vulnerability.
In addition to CVE-2026-125350, the updates address three other critical vulnerabilities, marking a total of eight actively exploited zero-day flaws patched by Google since January 2026.
To protect themselves, Google recommends updating Chrome to version 157.0.8103.50 or later for Windows and macOS, and version 157.0.8103.50 for Linux. Users can check for updates by navigating to More > Help > About Google Chrome and selecting Relaunch.
Other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also urged to implement these fixes. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerabilities catalog, mandating federal agencies to install the patch by November 24, 2026.