[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEpf4eZh_um0nhn9U-cyc-Eb8kKW2TUcY3K6X-0hBpXA":3},{"article":4,"iocs":55,"watch_terms":83,"solutions":84,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"c4622a68-69c2-49dc-99d4-79627f147f7b","Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely","google-chrome-0-day-vulnerability-in-the-wild-to-execute-malicious-code-remotely-4260ae","Google has fixed a Chrome zero-day that attackers are already using. The flaw is tracked as CVE-2026-125350, and it lets a remote attacker run malicious code in the browser. Google’s Stable channel update moves Chrome to version 157.0.8103.50\u002F.51 for Windows and Mac and 157.0.8103.50 for Linux. The rollout will reach users over the coming days […] The post Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely appeared first on Cyber Security News.","Google has released a patch for a critical zero-day vulnerability in Chrome, tracked as CVE-2026-125350, which allows remote attackers to execute malicious code. The flaw, a use-after-free bug in the XML component, was actively exploited before the fix was deployed. This update also addresses eight other vulnerabilities, with seven rated as High severity.","Google Chrome zero-day vulnerability (CVE-2026-125350) exploited in the wild for remote code execution.","https:\u002F\u002Fcybersecuritynews.com\u002Fgoogle-chrome-0-day-exploited\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGoogle-Chrome-0-Day-Exploited.webp","2026-11-10T04:21:10+00:00","2026-11-10T05:00:21.848644+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Google Chrome","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},"XML","technology",{"name":27,"type":25},"V8",{"name":29,"type":25},"WebGL",{"name":31,"type":25},"FileSystem","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,72,75,78,81],{"type":57,"value":58,"context":59},"cve","CVE-2026-125350","Zero-day vulnerability in Chrome's XML component exploited in the wild.",{"type":57,"value":61,"context":62},"CVE-2026-125345","Uninitialized resource vulnerability in WebGL.",{"type":57,"value":64,"context":65},"CVE-2026-125347","Incorrect authorization vulnerability in FileSystem.",{"type":57,"value":67,"context":68},"CVE-2026-125343","Buffer overflow vulnerability in Compositing.",{"type":57,"value":70,"context":71},"CVE-2026-125348","Out-of-bounds write vulnerability in GPU.",{"type":57,"value":73,"context":74},"CVE-2026-125344","Type confusion vulnerability in V8.",{"type":57,"value":76,"context":77},"CVE-2026-125346","Use-after-free vulnerability in XML.",{"type":57,"value":79,"context":80},"CVE-2026-125349","Uninitialized resource vulnerability in GPU.",{"type":57,"value":82,"context":80},"CVE-2026-125342",[21,18],{"controls":85,"vendors":173},[86,115,144],{"slug":87,"name":88,"problem":89,"products":90},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":116,"name":117,"problem":118,"products":119},"patch-management","Automated patch management","Known holes get closed in days, not months.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":145,"name":146,"problem":147,"products":148},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[149,157,165],{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":166,"vendor_name":167,"vendor_logo":168,"product_slug":169,"product_name":170,"url":171,"description":172},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[174],{"slug":175,"name":21,"logo_path":176,"roles":177},"google","\u002Fvendor-logos\u002Fgoogle.png",[178],"affected",{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":191},"chrome-zero-day-exploited-in-the-wild-before-patch-deployment","Chrome Zero-Day Exploited in the Wild Before Patch Deployment","A critical use-after-free vulnerability in Google Chrome's XML component (CVE-2026-125350) was actively exploited by attackers to execute malicious code remotely before Google could deploy a fix, classifying it as a true zero-day. Use-after-free bugs are particularly dangerous because they corrupt memory in ways that allow attackers to hijack program execution with high reliability. The fact that exploitation occurred in the wild means real users were compromised during the window between discovery and patch release. Organizations that delay browser updates — even by hours or days — dramatically increase their exposure to these types of commodity attacks targeting widely-used software.",[184,185,186,187,188,189,190],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":192,"PCI DSS Requirement 6":193,"NIST SP 800-53 SI-2: Flaw Remediation":194,"OWASP A06:2021 Vulnerable and Outdated Components":195,"CIS Control 7: Continuous Vulnerability Management":196,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":197,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":198},"NIS2 requires entities to implement vulnerability handling and disclosure policies; this incident underscores the obligation to have rapid patch response procedures in place for widely exploited software like browsers.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems by applying security patches in a timely manner, which would have required organizations in scope to patch this critical Chrome vulnerability immediately upon availability.","SI-2 mandates that organizations identify, report, and correct information system flaws on defined timelines — a formal flaw remediation process would have ensured the Chrome patch was pushed enterprise-wide immediately upon release.","Chrome itself is a third-party component in the enterprise software stack; OWASP A06 highlights the risk of running outdated or vulnerable components, which applies directly to unpatched browser versions being exploited via this zero-day.","This control requires organizations to continuously assess and remediate vulnerabilities; had automated patch deployment been enforced for Chrome, the exploitation window for CVE-2026-125350 would have been minimized to near zero.","This control requires timely identification and remediation of technical vulnerabilities; applying it to browser software would have ensured patch deployment before in-the-wild exploitation could affect organizational endpoints.","Limiting browser access to only necessary, managed, and up-to-date instances through access controls would reduce the attack surface exposed by vulnerable Chrome versions on unmanaged or unpatched devices."]