Vendor-confirmed zero-dayZero-dayGoogle ChromeWeb browsers

Google says attackers are exploiting a flaw in Chrome

What it is: Use after free in XML
Who's affected: Anyone using Google Chrome.
Under attack?: Yes. Google says: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
What to do: Update Chrome: open the menu, then Help, then About Google Chrome, and relaunch.
Fixed in: See the vendor's advisory
Zero-day?: Yes. The vendor said it was already being exploited when it released the fix, so attackers had it before anyone could patch.

Attack timeline

Nov 9, 2026Google confirmed attacksThe vendor's own advisory says it is being exploited.
Nov 9, 2026same dayPatch Sonar flagged itBefore CISA
PendingNot on CISA's list yetWe'll add the date when CISA lists it.

CVE-2026-125350Confirmed by the vendor Nov 9, 2026Source: Google advisory ↗

Google scorecard: every exploited Google flaw →

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Google Chrome

Hi [Client name],

Attackers are actively exploiting a security flaw in Google Chrome.

Who's affected: Anyone using Google Chrome.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Update Chrome: open the menu, then Help, then About Google Chrome, and relaunch.

Fixed in: See the vendor's advisory
Reference: CVE-2026-125350 – https://chromereleases.googleblog.com/

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

Google says attackers are exploiting a flaw in Chrome

Attack timeline

Also under attack in Web browsers