Google Chrome Exploited Use-After-Free Vulnerability in XML

# Google Chrome Exploited Use-After-Free Vulnerability in XML

https://gcdradar.vercel.app/incidents/google-chrome-exploited-use-after-free-vulnerability-in-xml · AIR-2026-1849 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild.
- Fix status: Partly patched
- First reported: 2026-11-10 (happened 2026-11-06)
- AI role: No AI role
- Products: Google Chrome
- CVE ids: CVE-2026-125350

## Summary

An anonymous report disclosed a high-severity use-after-free flaw in Google Chrome's XML component. The vulnerability is currently being exploited in active attacks in the wild.

## What to do

Update Google Chrome to the latest version immediately.

## Latest updates

- 2026-11-10: Added to the CISA KEV catalog (exploitation confirmed) (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350)
- 2026-11-10: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year (https://securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year)

## Sources

- 2026-11-10 SecurityWeek: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year https://securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year
- 2026-11-10 The Hacker News: Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
- 2026-11-10 BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year https://bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year
- 2026-11-10 CISA: CVE-2026-125350: Google Chromium — Google Chromium Use-After-Free Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350
- 2026-11-11 The Register: Chrome zero-day whack-a-mole continues as 2026 tally hits 8 https://theregister.com/security/2026/11/10/chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8/5308732

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.