HomeNovember 2026 patch cycleCVE-2026-125350: Chrome XML zero-day, Edge fix pending
Call: Patch nowCategory: EnterpriseCategory: End-user apps
CVE-2026-125350: Chrome XML zero-day, Edge fix pending
Part of November 2026 patch cycle
- Products
- Google Chrome, Microsoft Edge, and Microsoft Edge for Android
- Published
- · updated
- Status
- Open
Call: Patch now. Google says “an exploit for CVE-2026-125350 exists in the wild.” It’s a high-severity use-after-free in Chrome’s XML component, fixed in the November 9 Stable update. CISA added it to KEV on November 10, due November 24. BleepingComputer counts it as Chrome’s eighth exploited zero-day this year.
What breaks: Memory safety, in the part of the browser that parses XML. Google hasn’t said who’s exploiting it or how. Bug details are restricted until most users are updated, as usual. The update carries nine security fixes in total, including a second XML use-after-free (CVE-2026-125346) that Google doesn’t list as exploited.
Who’s hit:
- Chrome: anything below 157.0.8103.50/.51 on Windows and Mac, or 157.0.8103.50 on Linux.
- Microsoft Edge for Android: fixed. On November 11 Microsoft released Edge for Android 157.0.4341.53 and says it “contains a fix for” CVE-2026-125350.
- Microsoft Edge on the desktop: still not fixed, as far as Microsoft’s own notes go, as of the evening of November 11. On November 9 Microsoft posted that it is “aware of the recent exploits existing in the wild” and is “actively working on releasing a security fix.” The latest desktop Stable listed there is still 157.0.4341.42 (November 5), which predates Google’s fix. Check that page before you mark Edge done.
- Other Chromium browsers follow their own schedules.
Workaround: Update and relaunch. The rollout is staged “over the coming days/weeks,” and a browser that never restarts never updates, so push it rather than wait. For desktop Edge, until Microsoft ships and lists a fix, the honest options are to use a patched Chrome for risky browsing or accept the gap a little longer. Android Edge users should update from the Play Store now.
Sources: Chrome Releases (opens in a new tab), Edge security release notes (opens in a new tab), CISA KEV (opens in a new tab), BleepingComputer (opens in a new tab).
Sources
- https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html (opens in a new tab)
- https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security (opens in a new tab)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog (opens in a new tab)
- https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/ (opens in a new tab)