[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSwuPsd1Z_lYGHgNbb-9eSLPOZMc74y3IDl99OlHAnhY":3},{"article":4,"iocs":46,"watch_terms":69,"solutions":70,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"ba35b48c-9cff-40d8-87f2-31779027f4ca","Google fixes the eighth actively exploited Chrome zero-day of 2026","google-fixes-the-eighth-actively-exploited-chrome-zero-day-of-2026-5413c6","Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported […]","Google has released an update for Chrome to address nine security vulnerabilities, including CVE-2026-125350, a critical use-after-free flaw in the XML component that has been actively exploited by attackers in the wild. This marks the eighth exploited Chrome zero-day discovered and patched by Google in 2026, highlighting a persistent trend of zero-day exploitation targeting the popular browser.","Google patched an actively exploited Chrome zero-day, CVE-2026-125350, a use-after-free flaw in XML.","https:\u002F\u002Fsecurityaffairs.com\u002F202772\u002Fbreaking-news\u002Fgoogle-fixes-the-eighth-actively-exploited-chrome-zero-day-of-2026.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2016\u002F03\u002Fgoogle-chrome-bounty-program.jpg","2026-11-10T10:05:00+00:00","2026-11-10T11:00:28.652149+00:00",9,[17,20,23,26],{"name":18,"type":19},"Chrome","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},"V8","technology",{"name":27,"type":25},"XML","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,57,60,63,65,67],{"type":48,"value":49,"context":50},"cve","CVE-2026-125350","Actively exploited Chrome zero-day vulnerability in XML component.",{"type":48,"value":52,"context":53},"CVE-2026-2441","Previously exploited Chrome zero-day vulnerability in CSS.",{"type":48,"value":55,"context":56},"CVE-2026-3909","Previously exploited Chrome zero-day vulnerability in Skia.",{"type":48,"value":58,"context":59},"CVE-2026-3910","Previously exploited Chrome zero-day vulnerability in V8 engine.",{"type":48,"value":61,"context":62},"CVE-2026-5281","Previously exploited Chrome zero-day vulnerability in Dawn (WebGPU).",{"type":48,"value":64,"context":59},"CVE-2026-11645",{"type":48,"value":66,"context":59},"CVE-2026-85046",{"type":48,"value":68,"context":59},"CVE-2026-87491",[21,18],{"controls":71,"vendors":152},[72,101,126],{"slug":73,"name":74,"problem":75,"products":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":102,"name":103,"problem":104,"products":105},"patch-management","Automated patch management","Known holes get closed in days, not months.",[106,114,118],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":102,"product_name":115,"url":116,"description":117},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":127,"name":128,"problem":129,"products":130},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[131,139,144],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":140,"product_name":141,"url":142,"description":143},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[153],{"slug":154,"name":21,"logo_path":155,"roles":156},"google","\u002Fvendor-logos\u002Fgoogle.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"chromes-eighth-zero-day-of-2026-underscores-browser-patching-urgency","Chrome's Eighth Zero-Day of 2026 Underscores Browser Patching Urgency","A critical use-after-free vulnerability in Chrome's XML component (CVE-2026-125350) was actively exploited in the wild before Google could patch it, representing the eighth such zero-day in 2026 alone. Use-after-free flaws allow attackers to execute arbitrary code by manipulating freed memory, making them highly dangerous for end users running unpatched browsers. The sheer frequency of exploited Chrome zero-days in 2026 signals that threat actors are systematically targeting browser attack surfaces at scale. Organizations that delay browser updates — even by hours or days — expose their entire workforce to drive-by exploitation and credential theft. This incident underscores that browser patching must be treated with the same urgency as operating system or server patching.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":171,"PCI DSS Requirement 6":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"OWASP A06:2021 Vulnerable and Outdated Components":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the persistent pattern of Chrome zero-days demands a documented, rapid-response patching procedure covered under this obligation.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems, including timely patching of critical vulnerabilities; organizations processing card data via Chrome-based interfaces would be non-compliant if this zero-day remained unpatched.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule; a strict remediation timeline for browser software would have minimized the window of exposure for this actively exploited CVE.","OWASP A06 specifically calls out the risk of running outdated software components; browsers are a commonly overlooked component that must be inventoried and updated with the same rigor as application libraries.","Establishing a continuous vulnerability management program with defined patch SLAs would ensure Chrome zero-days are remediated within hours of patch availability rather than leaving users exposed to active exploitation.","This control requires timely identification and remediation of technical vulnerabilities in software; applying it to end-user browsers like Chrome would have mandated emergency patching upon disclosure of CVE-2026-125350.","While primarily an access control reference, the CSF Protect function broadly demands reducing attack surface on user-facing assets; ensuring browsers are patched and hardened directly limits attacker footholds gained via zero-day exploitation."]