Google has patched CVE-2026-125350 in Chrome's XML component. The flaw was exploited before the fix shipped and also affects Edge, Brave and Opera users.
Google released a Chrome update on 10 November 2026 that closes nine security flaws. One of them, CVE-2026-125350, was already being used in real attacks before the patch shipped. Google confirmed that an exploit for the flaw exists in the wild. The bug is a use-after-free condition in the browser's XML component — memory that has been released is accessed again — and carries a CVSS score of 8.8, rated high severity (The Hacker News).
What this means in practice: when a user opens a specially crafted web page, an attacker can execute code inside the browser's sandbox. The flaw was reported to Google on 6 November by an anonymous researcher and patched four days later.
Which version is safe?
Every Chrome build before 157.0.8103.50 is affected. The safe versions are (Qualys):
- Windows and macOS: 157.0.8103.50 or 157.0.8103.51
- Linux: 157.0.8103.50
Because the flaw sits in the Chromium engine, this is not a Chrome-only problem. Microsoft Edge, Brave, Opera and Vivaldi users need to apply their own vendor updates as well. That detail matters in corporate environments, where Edge is usually the default browser.
Why it deserves attention
This is the eighth confirmed actively exploited Chrome zero-day Google has patched during 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue and set a patching deadline of 24 November 2026 for federal agencies. A place on the KEV list is the official confirmation that a vulnerability is not a theoretical risk but an attack method in current use.
What it means for SMEs
In small and mid-sized companies, most of the working day now happens inside the browser: e-invoicing portals, banking screens, cloud accounting, webmail, ERP front ends, remote desktop gateways. The browser is no longer just an application — it is where the company's credentials and session cookies live. Even so, in many organisations browser updates are left entirely to the individual employee, and a restart postponed for weeks is often the only thing standing between a patched and an unpatched machine.
There is a compliance angle too. If a hijacked browser session exposes customer or staff records, that is a personal data breach, and under Turkey's KVKK the data controller has to notify the Authority. "The patch was available but not applied" is not a position that helps during an assessment.
What Kamer Bilişim recommends
- Do not leave browser updates to the user. Enforce automatic updates through group policy for Chrome Enterprise or Edge, and set a maximum relaunch window of 48 hours. It is a one-time configuration that removes the manual scramble every time a flaw like this appears.
- Build and verify a version inventory. If you do not know which browser version runs on which device, you cannot know whether the patch landed. chrome://settings/help covers a single machine; across a fleet, report it through central management or a remote monitoring tool.
- Do not treat the browser as your only line of defence. Restrict extension installs to an allow-list, filter malicious domains at the DNS layer, and make sure your endpoint protection actually monitors browser processes. By definition a zero-day has a window before the patch arrives; layered defence is what covers that window.
If you want to review your browser and endpoint update policy, build a current version inventory, or move to centralised patch management, you can reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support nationwide.
Source: The Hacker News, Qualys ThreatPROTECT, CISA Known Exploited Vulnerabilities Catalog
Source: The Hacker News