[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffyxU5tAYhQlJBkjNW3r4w_OW42SD5bn8CZ9rp94ES1E":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f05714dc-6264-4e48-8867-21fc073f870b","CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks","cisa-warns-of-google-chromium-0-day-vulnerability-actively-exploited-in-attacks-aa30df","CISA has added a new Google Chromium zero-day CVE-2026-125350 to its Known Exploited Vulnerabilities (KEV) catalog and says attackers are already using it. It sits in the browser’s XML component and could let a remote attacker run code through a specially crafted webpage. Anyone who uses Chrome, Edge, or Opera should check their browser version […] The post CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks appeared first on Cyber Security News.","CISA has added a Google Chromium zero-day vulnerability, CVE-2026-125350, to its Known Exploited Vulnerabilities (KEV) catalog, indicating it is actively being exploited. The use-after-free bug resides in the browser's XML component and could allow a remote attacker to execute arbitrary code within the browser sandbox through a specially crafted webpage. Google released a patch on November 9, 2026, with specific version numbers for Windows, Mac, and Linux.","CISA adds Google Chromium 0-day CVE-2026-125350 to KEV catalog, actively exploited.","https:\u002F\u002Fcybersecuritynews.com\u002Fgoogle-chromium-0-day-vulnerability-exploited\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FCISA-Warns-of-Google-Chromium-0-Day-Vulnerability-Actively-Exploited-in-Attacks.webp","2026-11-12T13:28:29+00:00","2026-11-12T14:00:25.537858+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Chrome","product",{"name":21,"type":19},"Edge",{"name":23,"type":19},"Opera",{"name":25,"type":19},"Chromium",{"name":27,"type":28},"Google","vendor",{"name":30,"type":28},"CISA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"cve","CVE-2026-125350","Google Chromium zero-day vulnerability",[27,30,18],{"controls":56,"vendors":143},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":87,"product_name":111,"url":112,"description":113},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[144],{"slug":145,"name":27,"logo_path":146,"roles":147},"google","\u002Fvendor-logos\u002Fgoogle.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"active-exploitation-of-chrome-zero-day-highlights-urgency-of-rapid-browser-patching","Active Exploitation of Chrome Zero-Day Highlights Urgency of Rapid Browser Patching","A use-after-free vulnerability in Google Chromium's XML component (CVE-2026-125350) was actively exploited in the wild before many organizations could apply the available patch, prompting CISA to add it to its Known Exploited Vulnerabilities catalog. The flaw allows a remote attacker to execute arbitrary code within the browser sandbox simply by luring a user to a specially crafted webpage, requiring no special privileges or user interaction beyond a click. Because browsers are universal, internet-facing attack surfaces on virtually every endpoint, delayed patching—even by days—creates a wide exploitation window. This incident underscores that zero-days with available patches must be treated as critical emergencies, not routine monthly updates.",[154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":160,"NIST SP 800-53 SI-2: Flaw Remediation":161,"CIS Control 7: Continuous Vulnerability Management (v8)":162,"CIS Control 2: Inventory and Control of Software Assets (v8)":163,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":164},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling, requiring entities to have processes for rapidly addressing vulnerabilities such as this actively exploited browser zero-day.","SI-2 explicitly requires organizations to identify, report, and correct information system flaws, and to install security-relevant updates within organizationally defined time periods—directly applicable to the delayed patching risk this incident exposes.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, including establishing a prioritized patching process that would mandate rapid response to an actively exploited zero-day like this one.","CIS Control 2 requires maintaining an accurate inventory of all software, including browser versions, which is a prerequisite for quickly identifying every affected endpoint when a browser zero-day is disclosed.","This category requires that once an actively exploited vulnerability is identified, the organization takes immediate mitigation action or formally accepts the risk—exactly the response CISA's KEV listing is designed to trigger."]