Google Fixes Actively Exploited Chrome Zero-Day in XML Component

En bref

• CVE-2026-125350 is a use-after-free flaw in Chrome's XML component and is confirmed exploited in the wild.
• The fix arrived Monday as part of a nine-vulnerability Chrome refresh from Google.
• It marks the eighth Chrome zero-day addressed in 2026, indicating sustained attacker interest.
• Unpatched browsers on district laptops, labs and Chromebooks remain exposed until updated and restarted.

Google issued a Chrome refresh on Monday that closes nine separate security defects, and one of them stands out: CVE-2026-125350, a use-after-free weakness in the browser's XML handling code. Google's advisory confirms the bug has already been used in real attacks, making it the eighth Chrome zero-day the company has had to address during 2026.

A use-after-free condition occurs when software continues to reference a memory region after releasing it. An attacker who can shape that memory can potentially redirect execution inside the browser process. Because XML parsing is reachable from ordinary web content, exposure generally begins the moment a user loads a crafted or compromised page — no unusual settings or extensions are required.

Practically everyone running an out-of-date Chrome build is in scope: district-managed Chromebooks, Windows computer labs, macOS carts and staff laptops alike. Chrome's background updater normally handles this quietly, but devices that sit powered off over a weekend, frozen lab images, or endpoints pinned to an older build for compatibility reasons can drift behind the patched release.

Why this matters for a K-12 environment is straightforward. The browser is the most heavily used application in schools, and it is the primary channel through which untrusted content reaches students and staff. A memory-corruption bug in a component that parses that content is a direct route in, and a zero-day being exploited before a fix existed means the window for opportunistic attacks is already open. Eight zero-days in a single year is a pace that argues for treating browser patching as a standing operational task rather than an occasional project.

What to watch: verify the actual Chrome version reporting from your fleet rather than assuming auto-update succeeded, and confirm devices have been restarted so the pending build takes effect. Keep an eye out for follow-up Google advisories, since zero-day disclosures are sometimes followed by additional detail or related fixes. Watch web-proxy and DNS logs for clusters of requests to newly registered or low-reputation domains, and treat repeated renderer crashes on a single endpoint as worth a closer look. Finally, identify any application or testing workflow that deliberately holds Chrome at an older version and set a deadline for retiring that exception.

À faire maintenant

1. Compare your fleet's reported Chrome version against Google's current stable release and force the update through your management console or GPO/ADMX policy.
2. Push a browser restart policy — Chrome only activates the patched build after relaunch, so devices left running for weeks may still be vulnerable.
3. Audit update health for Google Update on Windows and macOS, and confirm ChromeOS devices are enrolled in a management policy that enforces version compliance.
4. Inventory exceptions: offline laptop carts, frozen lab images, and any endpoint deliberately pinned to an older Chrome build; reimage or update these first.
5. Hunt for exploitation signals — anomalous child processes spawned by the browser, repeated renderer crashes, and proxy or DNS hits to newly registered or low-reputation domains.
6. Enable enhanced Safe Browsing and tighten web filtering for untrusted categories while the rollout completes.
7. Document patch compliance with timestamps and escalate any endpoint that cannot be updated within 72 hours to your security lead.

Références CVE

• CVE-2026-125350

Source originale

The Hacker News