Chrome zero-day lets a malicious web page run code in the browser, attacks under way (CVE-2026-125350)

11 November 2026High 8.8Being exploited

Google · Google Chrome and other Chromium-based browsers · CVE-2026-125350

Chrome zero-day lets a malicious web page run code in the browser, attacks under way

A memory flaw (use after free) in the part of Chrome that handles XML lets a crafted web page run code inside the browser's sandbox. Google says an exploit for it exists in the wild, and CISA added it to its Known Exploited Vulnerabilities catalogue on 10 November. Google has not said who is being targeted or how.

Affected: Google Chrome before 157.0.8103.50 on Windows, Mac and Linux. CISA notes it could also affect other browsers built on Chromium, including Microsoft Edge and Opera.
What to do: Update Chrome to 157.0.8103.50 or .51 on Windows and Mac, or 157.0.8103.50 on Linux, then restart the browser so the update takes effect. The same release fixes eight other security flaws. Update Edge, Opera and other Chromium-based browsers as their own fixes arrive.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited zero-day in the browser most people use; on CISA's catalogue.

Chrome zero-day lets a malicious web page run code in the browser, attacks under way

Affected

Google Chrome before 157.0.8103.50 on Windows, Mac and Linux. CISA notes it could also affect other browsers built on Chromium, including Microsoft Edge and Opera.

What to do

Update Chrome to 157.0.8103.50 or .51 on Windows and Mac, or 157.0.8103.50 on Linux, then restart the browser so the update takes effect. The same release fixes eight other security flaws. Update Edge, Opera and other Chromium-based browsers as their own fixes arrive.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited zero-day in the browser most people use; on CISA's catalogue.