← All security news
SecurityPatchHIGHEXPLOITED IN THE WILD

Update Chrome now: Google fixes CVE-2026-125350, a zero-day already exploited in attacks, in Chrome 157.0.8103.50

· 1 min read

Google says an exploit for CVE-2026-125350, a use-after-free flaw in Chrome's XML code, exists in the wild. The 9 November update to 157.0.8103.50/.51 fixes it and eight other bugs. Google has not said who was attacked.

Google Chrome

On 9 November 2026 Google released a Chrome security update that fixes CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML code. Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild", which makes it a zero-day: attackers were using it before the fix was out. An anonymous researcher reported it on 6 November.

Fixed versions: Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. Older versions are affected.

The update fixes nine flaws in total: seven rated High and two Medium, none Critical. They include a second XML use-after-free (CVE-2026-125346), a type confusion bug in the V8 JavaScript engine (CVE-2026-125344), and bugs in Compositing, the GPU code, WebGL and FileSystem. Google has reported exploitation only for CVE-2026-125350.

What is not known: Google has not said how the attacks work, who is behind them or who was targeted. It usually keeps bug details restricted until most users have the fix.

Google says the update rolls out over "days/weeks", so Chrome may not have installed it yet. Other browsers built on Chromium, such as Edge, Brave and Opera, need their own updates.

More news

PHP
VulnerabilityCRITICALEXPLOITED IN THE WILD

CISA confirms PHP2Shell is exploited; US agencies must patch by 29 October

The two PHP core flaws fixed on 21 October are now in CISA's Known Exploited Vulnerabilities catalog, and JPCERT/CC reports public exploit code and attack traffic.

· CVE-2026-109618 · CVE-2026-109619
ForgeRock OpenIDM
VulnerabilityHIGH

From a number plate to an unlocked car: researchers took over owners' accounts at two automakers through a hardcoded password and a WAF bypass

Shubham Shah and Sam Curry chained leaked admin credentials, a path-traversal WAF bypass and a factory-default console login in two carmakers' ForgeRock identity servers to unlock, honk and start cars in Australia and the US. The carmakers, unnamed, fixed it.

Report URI
IncidentHIGH

15,579 websites are serving malicious JavaScript right now, Report URI says, and it can't reach most of their owners

Report URI's crawler has confirmed 15,579 sites running card skimmers, ClickFix lures, iPhone spyware loaders or scam redirects, with an estimated 135 million+ visits a month. Founder Scott Helme says most owners can't be contacted, so he is asking CERTs for help.