---
id: "CMP-202611-7franc"
page: "https://infrastack.ai/live/CMP-202611-7franc"
kind: "campaign"
aliases: []
title: "Attackers exploit a Chrome zero-day (CVE-2026-125350, use-after-free in XML handling); fixed in Chrome 157.0.8103.50/.51 on desktop and Android"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Google Chrome", "fixed": ["157.0.8103.50", "157.0.8103.51"], "vendor": "Google", "affected": "< 157.0.8103.50"}, {"name": "Google Chrome for Android", "fixed": ["157.0.8103.50"], "vendor": "Google", "affected": "< 157.0.8103.50"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-11-09T00:00:00+00:00"
first_seen_at: "2026-11-10T14:00:29+00:00"
updated_at: "2026-11-10T14:01:11+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-10T14:00:29+00:00"}]
exploit_sources: []
---

# Attackers exploit a Chrome zero-day (CVE-2026-125350, use-after-free in XML handling); fixed in Chrome 157.0.8103.50/.51 on desktop and Android

Link for people: https://infrastack.ai/live/CMP-202611-7franc (this .md is for agents)

On 9 Nov 2026 Google released a Chrome Stable update for Windows, Mac, Linux and Android with nine security fixes. One of them is CVE-2026-125350, a high-severity use-after-free in Chrome's XML component. Google says it is aware that an exploit for it exists in the wild. An unnamed third party reported it to Google on 6 Nov 2026. Google has not said who the attackers are, who they target, how the exploit is delivered or what it can do. HKCERT rates the overall risk of the update 'Extremely High' and says some of the fixed flaws can lead to denial of service, security restriction bypass or remote code execution. The update rolls out over days to weeks, so unpatched browsers will stay exposed for a while (Malwarebytes).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Google Chrome affected < 157.0.8103.50 fixed 157.0.8103.50, 157.0.8103.51
- :Google Chrome for Android affected < 157.0.8103.50 fixed 157.0.8103.50

## Cause

How the attacker got in: not disclosed yet (unknown). The record says Google has not said how the exploit is delivered or who the attackers are, so neither how the attacker got in nor how the incident reaches users is stated.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

Check the Chrome version under Settings > About Google Chrome. Exposed: Windows and Mac older than 157.0.8103.50/.51, Linux older than 157.0.8103.50, Android older than 157.0.8103.50. Browsers that never get closed, or that an extension stops from updating, can stay on old versions. Other Chromium-based browsers likely share the XML code, but vendors have not confirmed this. No indicators of compromise have been published (unknown).

## Fix

Update Chrome now: open About Google Chrome, let it download the update and click Relaunch. On Android, update Chrome from Google Play. Use fleet management to push 157.0.8103.50/.51 and make sure browsers restart. Watch for updates from other Chromium-based browser vendors.

## Timeline

- 2026-11-10T14:00:29+00:00 analyst

## Documents

- [describes] Malwarebytes Labs: Update Chrome now to fix a flaw attackers are exploiting https://www.malwarebytes.com/blog/bugs/2026/11/update-chrome-now-to-fix-a-flaw-attackers-are-exploiting

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_