Google fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Publicly disclosed: 9 November 2026
On 9 November 2026 Google released Chrome 157.0.8103.50/.51 to fix a high-severity use-after-free flaw in the browser's XML component. Google said it was aware that an exploit exists in the wild. CISA added the flaw to its exploited catalog on 10 November. Such browser flaws are typically used to infect a computer when the user simply visits a malicious or compromised website.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2026-125350 | High (use-after-free) — exploited | Google Chrome on Windows, macOS, Linux, Android | 157.0.8103.50 / .51 and later |
A browser that has not been restarted for weeks is a browser that has not been updated.
Sources: Malwarebytes, 10 Nov 2026, CISA alert, 10 Nov 2026.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleOn SonicWall firewalls that use SAML for SSL VPN, attackers with stolen credentials could skip SAML checks — including MFA. Fixed firmware and what to do.
Read articleOur engineers can review your current setup and propose concrete improvements.
