{"id":"CMP-202611-7franc","kind":"campaign","aliases":[],"related":["CVE-2026-125350"],"title":"Attackers exploit a Chrome zero-day (CVE-2026-125350, use-after-free in XML handling); fixed in Chrome 157.0.8103.50/.51 on desktop and Android","description":null,"summary":"On 9 Nov 2026 Google released a Chrome Stable update for Windows, Mac, Linux and Android with nine security fixes. One of them is CVE-2026-125350, a high-severity use-after-free in Chrome's XML component. Google says it is aware that an exploit for it exists in the wild. An unnamed third party reported it to Google on 6 Nov 2026. Google has not said who the attackers are, who they target, how the exploit is delivered or what it can do. HKCERT rates the overall risk of the update 'Extremely High' and says some of the fixed flaws can lead to denial of service, security restriction bypass or remote code execution. The update rolls out over days to weeks, so unpatched browsers will stay exposed for a while (Malwarebytes).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T14:00:29+00:00","products":[{"name":"Google Chrome","fixed":["157.0.8103.50","157.0.8103.51"],"vendor":"Google","affected":"< 157.0.8103.50"},{"name":"Google Chrome for Android","fixed":["157.0.8103.50"],"vendor":"Google","affected":"< 157.0.8103.50"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Check the Chrome version under Settings > About Google Chrome. Exposed: Windows and Mac older than 157.0.8103.50/.51, Linux older than 157.0.8103.50, Android older than 157.0.8103.50. Browsers that never get closed, or that an extension stops from updating, can stay on old versions. Other Chromium-based browsers likely share the XML code, but vendors have not confirmed this. No indicators of compromise have been published (unknown).","fix":"Update Chrome now: open About Google Chrome, let it download the update and click Relaunch. On Android, update Chrome from Google Play. Use fleet management to push 157.0.8103.50/.51 and make sure browsers restart. Watch for updates from other Chromium-based browser vendors.","status":"open","published_at":"2026-11-09T00:00:00+00:00","first_seen_at":"2026-11-10T14:00:29+00:00","triaged_at":"2026-11-10T14:00:29+00:00","updated_at":"2026-11-10T14:01:11+00:00","category":"runtime","confidence":null,"triage":{"cause":{"at":"2026-11-10T14:05:34Z","path":"unknown","entry":"unknown","reason":"The record says Google has not said how the exploit is delivered or who the attackers are, so neither how the attacker got in nor how the incident reaches users is stated.","confidence":0.9}},"analyst_status":"done","analyst_note":null,"search":"'-125350':10A,67B '-2026':9A,66B '-202611':28A '-7':29A '/.51':22A '157.0.8103.50':21A '2026':44B,106B '6':104B '9':42B 'android':26A,36A,56B 'attack':1A,113B 'awar':85B 'browser':168B 'bypass':153B 'campaign':37B 'chrome':4A,20A,32A,34A,48B,77B 'cmp':27A 'code':156B 'compon':80B 'cve':8A,65B 'day':7A,163B 'deliv':122B 'denial':148B 'desktop':24A 'earli':39B 'early-warn':38B 'execut':157B 'exist':91B 'exploit':2A,88B,120B 'expos':171B 'extrem':136B 'fix':18A,60B,143B 'flaw':144B 'for':35A 'franc':30A 'free':14A,75B 'googl':45B,81B,102B,107B 'google':31A,33A 'handl':17A 'high':70B,137B 'high-sever':69B 'hkcert':128B 'lead':146B 'linux':54B 'mac':53B 'malwarebyt':175B 'nine':58B 'nov':43B,105B 'one':61B 'overal':131B 'parti':98B 'rate':129B 'releas':46B 'remot':155B 'report':99B 'restrict':152B 'risk':132B 'roll':160B 'said':110B 'say':82B,139B 'secur':59B,151B 'servic':150B 'sever':71B 'stabl':49B 'stay':170B 'target':117B 'third':97B 'unnam':96B 'unpatch':167B 'updat':50B,135B,159B 'use':12A,73B 'use-after-fre':11A,72B 'warn':40B 'week':165B 'wild':94B 'window':52B 'xml':16A,79B 'zero':6A 'zero-day':5A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["chrome","chromeforandroid","googlechrome","googlechromeforandroid"],"ptokens":["android","chrome","for","google"],"labels":["campaign","earlywarning","high","runtime"],"campaign_type":"exploitation","search_a":"'-125350':10A '-2026':9A '-202611':28A '-7':29A '/.51':22A '157.0.8103.50':21A 'android':26A,36A 'attack':1A 'chrome':4A,20A,32A,34A 'cmp':27A 'cve':8A 'day':7A 'desktop':24A 'exploit':2A 'fix':18A 'for':35A 'franc':30A 'free':14A 'google':31A,33A 'handl':17A 'use':12A 'use-after-fre':11A 'xml':16A 'zero':6A 'zero-day':5A","search_b":"'-125350':67B '-2026':66B '2026':44B,106B '6':104B '9':42B 'android':56B 'attack':113B 'awar':85B 'browser':168B 'bypass':153B 'campaign':37B 'chrome':48B,77B 'code':156B 'compon':80B 'cve':65B 'day':163B 'deliv':122B 'denial':148B 'earli':39B 'early-warn':38B 'execut':157B 'exist':91B 'exploit':88B,120B 'expos':171B 'extrem':136B 'fix':60B,143B 'flaw':144B 'free':75B 'googl':45B,81B,102B,107B 'high':70B,137B 'high-sever':69B 'hkcert':128B 'lead':146B 'linux':54B 'mac':53B 'malwarebyt':175B 'nine':58B 'nov':43B,105B 'one':61B 'overal':131B 'parti':98B 'rate':129B 'releas':46B 'remot':155B 'report':99B 'restrict':152B 'risk':132B 'roll':160B 'said':110B 'say':82B,139B 'secur':59B,151B 'servic':150B 'sever':71B 'stabl':49B 'stay':170B 'target':117B 'third':97B 'unnam':96B 'unpatch':167B 'updat':50B,135B,159B 'use':73B 'use-after-fre':72B 'warn':40B 'week':165B 'wild':94B 'window':52B 'xml':79B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-7franc","url":null,"severity":null,"published_at":"2026-11-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-10T14:00:29+00:00","fetched_at":"2026-11-10T14:00:29+00:00","note":null}],"documents":[{"id":115285,"url":"https://www.malwarebytes.com/blog/bugs/2026/11/update-chrome-now-to-fix-a-flaw-attackers-are-exploiting","title":"Malwarebytes Labs: Update Chrome now to fix a flaw attackers are exploiting","kind":"blog","source":"blog","publisher":null,"text":"Update Chrome now to fix a flaw attackers are exploiting\n\nGoogle has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.","published_at":"2026-11-10T13:23:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}