[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-4FyI3xivNtEg7_XaQfNDpqMXK1brulNGUazMd1LPjg":3},{"article":4,"iocs":46,"watch_terms":66,"solutions":67,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"a2ecf050-3e96-43f3-a5c1-90730c82a47f","Chrome Update Patches Exploited XML Zero-Day, Eighth This Year","chrome-update-patches-exploited-xml-zero-day-eighth-this-year-eb5d33","The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek.","Google has released an update for Chrome to patch nine vulnerabilities, including a high-severity zero-day exploit in its XML component. This vulnerability, tracked as CVE-2026-125350, was reported anonymously and is already being exploited in the wild. This marks the eighth zero-day vulnerability in Chrome to be exploited this year, highlighting a persistent target for attackers.","Google Chrome update addresses an exploited XML zero-day vulnerability, the eighth this year.","https:\u002F\u002Fwww.securityweek.com\u002Fchrome-update-patches-exploited-xml-zero-day-eighth-this-year\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002FChrome.jpeg","2026-11-10T06:12:24+00:00","2026-11-10T07:00:05.006484+00:00",9,[17,20],{"name":18,"type":19},"Chrome","product",{"name":21,"type":22},"Google","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,56,58,60,62,64],{"type":48,"value":49,"context":50},"cve","CVE-2026-125350","Exploited zero-day vulnerability in Chrome's XML component.",{"type":48,"value":52,"context":53},"CVE-2026-2441","Previously exploited Chrome zero-day.",{"type":48,"value":55,"context":53},"CVE-2026-3909",{"type":48,"value":57,"context":53},"CVE-2026-3910",{"type":48,"value":59,"context":53},"CVE-2026-5281",{"type":48,"value":61,"context":53},"CVE-2026-11645",{"type":48,"value":63,"context":53},"CVE-2026-85046",{"type":48,"value":65,"context":53},"CVE-2026-87491",[21,18],{"controls":68,"vendors":154},[69,98,127],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":45,"name":128,"problem":129,"products":130},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":148,"vendor_name":21,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[155],{"slug":148,"name":21,"logo_path":149,"roles":156},[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"chrome-xml-zero-day-exploited-in-the-wild-eighth-this-year","Chrome XML Zero-Day Exploited in the Wild — Eighth This Year","Google patched a high-severity zero-day vulnerability (CVE-2026-125350) in Chrome's XML component that was already being actively exploited before a fix was available, making it the eighth Chrome zero-day exploited this year. Zero-day vulnerabilities are particularly dangerous because defenders have no advance warning and no patch to apply at the moment of discovery, leaving users exposed until the vendor releases a fix. The repeated pattern of Chrome zero-days being exploited in the wild underscores that widely used browsers are high-value targets, and organizations that delay browser updates — even by hours — risk compromise. Rapid patch deployment and automated update enforcement are critical controls when zero-days are disclosed alongside active exploitation.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":171,"PCI DSS Requirement 6":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"OWASP A06:2021 Vulnerable and Outdated Components":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the repeated exploitation of Chrome zero-days signals that organizations subject to NIS2 must have formal, rapid-response patching procedures for widely deployed software.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying critical security patches within one month of release, a standard that must be tightened to hours when active exploitation is confirmed as in this incident.","SI-2 requires organizations to identify, report, and correct system flaws and install security-relevant software updates within defined timeframes, directly addressing the need for emergency patch deployment when exploitation is confirmed in the wild.","Chrome's XML component represents a third-party software component used at massive scale; this risk category highlights the danger of running outdated or unpatched components and the need to continuously monitor for newly disclosed vulnerabilities in them.","This control mandates establishing a process to continuously acquire, assess, and remediate vulnerabilities; had organizations enforced rapid browser patching cycles, the window of exposure to this actively exploited zero-day would have been minimized.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, including rapid patching, which is precisely what failed for organizations still running unpatched Chrome versions after disclosure.","While primarily an authentication control, enforcing least-privilege browsing environments and restricting which users can run unmanaged browser versions limits the attack surface available to exploit browser zero-days."]