Attackers are using this November 9, 2026 Critical severity

Chrome flaw used in attacks

A flaw in XML, “Use after free in XML”, lets a booby-trapped web page run code. Google says an exploit exists in the wild. Fixed in Chrome 157.0.8103.50.

On a Mac

Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.

The fix

• Chrome 157.0.8103.50
• Electron 43.8.8, 44.11.0 and 45.3.0

Attacks

In CISA’s catalog of exploited flaws since November 10, 2026.

CVE

CVE-2026-125350

Sources

• chromereleases.googleblog.com
• cisa.gov

From the Briefing, updated 32 minutes ago.