93← Home

Google Updates Confirm 4 Critical Chrome Security Bugs And 1 Zero-Day

Headline from Forbes · compiled from 6 sources

Our analysis · checked against 15 sources

Google patches exploited Chrome flaw, rated High, and separately fixes several Critical bugs

Google says an exploit for CVE-2026-125350, an XML flaw it rates High, exists in the wild; it shipped fixes on Nov 9, the eighth exploited Chrome zero-day of 2026, level with 2025's eight. A separate Nov 11 update fixed 81 (Forbes) or 83 (BigGo/Cyberpress) issues, four or five rated Critical, none reported exploited.

The framing'Critical' does reflect Google's top severity rating for four or five bugs in the Nov 11 update. But the one bug confirmed exploited, CVE-2026-125350, is rated High by Google, and none of the Critical bugs is reported as exploited.

What the headline leaves out

  • The exploited bug is rated High, not Critical; the Critical bugs have no reported exploitation.
  • Google has not named attackers, targets or delivery method.
  • The fix rolls out over days or weeks and needs a browser relaunch; Microsoft Edge had not shipped its fix as of Nov 10.
  • The bug runs code inside the renderer sandbox; no public evidence of a sandbox-escape chain.

What happens next

Chrome 158 is scheduled to reach Stable on Nov 17, and US federal agencies must patch by Nov 24 under CISA rules. ThreatDefence's Anton Guzhevskiy warns in-the-wild Chrome exploits usually come as chains, so an exploited renderer should be treated as possible full compromise. Watch for Microsoft Edge's fix and any Google disclosure of targets or a linked sandbox escape.

Possible knock-on effects
  • Attackers could pair this renderer bug with a sandbox escape, so organisations may need to hunt for compromise, not just patch. (named expert: Anton Guzhevskiy, ThreatDefence, quoted by Forbes. Watch for: Disclosure of a Chrome sandbox-escape bug linked to CVE-2026-125350)
  • Other Chromium-based browsers that lag Chrome's fix, such as Edge, may leave their users exposed until they ship it. (mechanism: Edge shares Chromium code and said on Nov 10 it was 'actively working' on a fix. Watch for: Edge security release notes listing CVE-2026-125350)

Sources: BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year, Malwarebytes: Update Chrome now, The Hacker News: Google issues Chrome security update, The Register: Chrome zero-day tally hits 8, Digital Citizen: Chrome 157 emergency update, BigGo Finance: Chrome Critical flaws, Cyberpress: Chrome patches 83 security flaws, Forbes: Google update confirms 4 critical Chrome security bugs and 1 zero-day, 2-Spyware: Chrome 157 fixes eighth exploited zero-day, SOCRadar: CVE-2026-125350 Google Chrome XML 0-day, ThreatDefence: Chrome CVE-2026-125350 zero-day patching and hunting, SOC Prime: CVE-2026-125350 Chrome XML zero-day exploited in the wild, DemandSage: Chrome statistics, AboutChromebooks: Global Chrome user base, Backlinko: Browser market share

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to Forbes, it's "been quite the week for Chrome browser users," as Google confirms and fixes 81 security vulnerabilities, including 4 critical ones and an already exploited zero-day.[1]

Forbes reports that across two updates, first to version 157.0.8103.50/.51 and now to 156.0.8078.100, a total of 81 vulnerabilities have been disclosed and fixed.[1]BleepingComputer reports that "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the company said in a Monday security advisory.[2] The Register describes the flaw as a high-severity use-after-free vulnerability in Chrome's XML component.[3]According to The Hacker News, an anonymous security researcher has been credited with discovering and reporting the flaw on November 6, 2026.[4] The Register reports that Google has patched its eighth actively exploited Chrome zero-day of 2026, matching its total for the whole of last year[3].Time News reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog, with a requirement for federal agencies to apply the patch by November 24, 2026.[5]ThreatDefence researcher Anton Guzhevskiy told Forbes that "Code that runs through this bug runs inside the renderer sandbox,"[1] and warned that "exploits used in the wild against Chrome usually come as such chains."[1]Forbes reports that the four critical-severity vulnerabilities all appeared in a November 11 security update from Google[1] and that all four are use-after-free bugs. A BigGo analysis cited by Forbes says "the affected components span ServiceWorker (CVE-2026-126885), CSS (CVE-2026-126895), Layout (CVE-2026-126879) and Accessibility (CVE-2026-126911)"[1].According to Cybersecurity News, Edge, Brave, Opera, and Vivaldi users should install their vendor's update as soon as it appears[6].

Listen to the songIT Security News — November 13, 2026

Sources

  1. [1]Google Updates Confirm 4 Critical Chrome Security Bugs And 1 Zero-Day
  2. [2]Google patches eighth Chrome zero-day exploited in attacks this year
  3. [3]Chrome zero-day whack-a-mole continues as 2026 tally hits 8
  4. [4]Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
  5. [5]Google Fixes Chrome Zero-Day and 8 Other Security Flaws - Time News
  6. [6]CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

Google Updates Confirm 4 Critical Chrome Security Bugs And 1 Zero-Day | 93