Google Patches Actively Exploited Chrome XML Security Flaw Arabian Post

(MENAFN- The Arabian Post) clearfix"> Google has issued an emergency security update for its Chrome browser after confirming that attackers are exploiting a high-severity vulnerability affecting the software's handling of XML data.

The update, published on 9 November, fixes nine security flaws in desktop Chrome, including CVE-2026-125350, a use-after-free vulnerability for which Google says an exploit exists in the wild. The company has not identified the attackers, disclosed their targets or described the scale of exploitation.

Chrome's stable channel has been updated to versions 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux. Google said the release would reach users progressively over the coming days and weeks, making version checks important for people whose browsers have not yet received the fixes.

Hong Kong's Computer Emergency Response Team Coordination Centre classified the collection of vulnerabilities as an extremely high risk on 10 November, highlighting the confirmed exploitation of the XML flaw. Its advisory warned that some weaknesses could allow remote code execution, bypass security restrictions or disrupt browser operation.

The exploited vulnerability arises from a use-after-free condition, a memory-management error in which software attempts to access memory after it has been released. Such flaws can cause crashes and, under certain circumstances, permit attackers to manipulate a vulnerable programme's behaviour. The precise method used against Chrome users has not been publicly detailed.

Google said CVE-2026-125350 was reported anonymously on 6 November, three days before the security release. It assigned the flaw a high severity rating but provided no technical account of the attacks. Confirmation of exploitation makes the defect a zero-day issue, distinguishing it from vulnerabilities disclosed without evidence of attacks.

See also AI features in 84% of surveyed ransomware incidents

The company is withholding some vulnerability information while patches reach a wider proportion of its users. Google said access to bug details and related links may remain restricted where disclosure could expose users who have not updated, or where a vulnerable third-party component also affects other projects.

Another high-severity flaw, CVE-2026-125346, concerns use-after-free behaviour in XML processing. That issue was reported by Arni Hardarson of Neonix Security on 12 October. Google has not stated that this second XML vulnerability is being exploited, and the two entries have separate identifiers and reporting histories.

The update also addresses CVE-2026-125344, a type-confusion problem in Chrome's V8 JavaScript engine, and CVE-2026-125348, an out-of-bounds write affecting its graphics processing unit component. Both are rated high severity, although Google has not identified either as under active exploitation.

Three additional high-severity fixes cover an uninitialised resource in WebGL, incorrect authorisation in FileSystem and a buffer overflow in Compositing. These are tracked respectively as CVE-2026-125345, CVE-2026-125347 and CVE-2026-125343. Together with the two XML issues, the V8 defect and the GPU write flaw, they account for seven high-severity vulnerabilities.

The remaining two fixes, CVE-2026-125349 and CVE-2026-125342, address uninitialised resources in the GPU component and carry medium severity ratings. Google's published list therefore contains seven high-severity issues and two medium-severity issues, with none designated critical.

Users can check their installed browser version through Chrome's Help menu and About Google Chrome page, where available updates are ordinarily downloaded and a relaunch completes installation. Restarting the browser matters because an update downloaded in the background does not necessarily protect an already running session until the new version starts.

See also EY breach reaches Goldman Sachs, Man Group clients

Organisations managing Chrome across employee computers may need to confirm deployment through their established browser-management systems, particularly where update schedules or restart policies delay installation. The published version numbers provide administrators with a specific benchmark for checking whether machines have received the November security fixes.

Google's separate Extended Stable release on 9 November brought Windows and macOS users on that channel to version 156.0.8078.96. Its advisory listed 11 security fixes, including CVE-2026-125350 and three other vulnerabilities also addressed in the standard stable-channel update.

The November patch follows the initial promotion of Chrome 157 to the stable channel on 3 November. That earlier desktop release carried versions 157.0.8103.38 for Linux and 157.0.8103.38 or.39 for Windows and macOS. The new security release therefore changes the build number within the same major browser version, rather than requiring users to move to a different product generation.

The company's disclosure credited internal Google reporting for several flaws and named independent researchers for others. Vo Duc Thang, identified as ugvxb, reported the medium-severity GPU issue CVE-2026-125342 on 26 September, while Google's advisory dated its report of CVE-2026-125349 to 20 July.

MENAFN10112026000152002308ID1111939971