[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiZ96VEJlXsaTrTx2yr0Lnl2ZlKeqyCvzoGLicUBZnvQ":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"770ebb44-d3a4-4661-b2eb-fc275480f040","Chrome zero-day whack-a-mole continues as 2026 tally hits 8","chrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8-98b0ee","Another Chrome memory bug gets squashed, but not before attackers got their hands on it","Google has released an update for Chrome to address its eighth actively exploited zero-day vulnerability of 2026, CVE-2026-125350. This high-severity use-after-free bug in Chrome's XML component was being exploited in the wild before a patch was available. The update, Chrome 157.0.8103.50\u002F.51 for Windows and macOS, and 157.0.8103.50 for Linux, also fixes eight other security vulnerabilities.","Google patches eighth actively exploited Chrome zero-day of 2026, CVE-2026-125350.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F10\u002Fchrome-zero-day-whack-a-mole-continues-as-2026-tally-hits-8\u002F5308732","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5308741&width=800","2026-11-10T13:28:00+00:00","2026-11-10T14:00:16.571313+00:00",9,[17,20,23,26],{"name":18,"type":19},"Chrome","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},"XML","technology",{"name":27,"type":25},"V8 JavaScript engine","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"cve","CVE-2026-125350","Actively exploited use-after-free vulnerability in Chrome's XML component.",{"type":48,"value":52,"context":53},"CVE-2026-125346","Use-after-free bug in Chrome's XML component, reported by Arni Hardarson of Neonix Security.",[21,18],{"controls":56,"vendors":129},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[120,121],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[130],{"slug":131,"name":21,"logo_path":132,"roles":133},"google","\u002Fvendor-logos\u002Fgoogle.png",[134],"affected",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"chromes-eighth-zero-day-of-2026-highlights-urgency-of-rapid-browser-patching","Chrome's Eighth Zero-Day of 2026 Highlights Urgency of Rapid Browser Patching","Google patched CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome's XML component that was actively exploited in the wild before a fix was available, marking the eighth Chrome zero-day of 2026. Zero-day exploitation means attackers had a window of opportunity with no vendor patch to close the gap, making rapid deployment of updates the only real defense once a fix is released. The sheer frequency of Chrome zero-days in 2026 demonstrates that browser attack surfaces are under sustained, targeted pressure. Organizations that delay browser updates even by hours or days materially increase their exposure to drive-by exploitation, credential theft, and sandbox escapes.",[140,141,142,143,144],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":146,"NIST SP 800-53 SI-2: Flaw Remediation":147,"CIS Control 7: Continuous Vulnerability Management (v8)":148,"CIS Control 2: Inventory and Control of Software Assets (v8)":149,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":150},"NIS2 Article 21(2)(e) explicitly covers vulnerability handling and disclosure in the context of security in acquisition, development and maintenance, obligating in-scope organizations to have processes that address actively exploited zero-days like this one without delay.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, directly covering the need to deploy Chrome's zero-day patch before exploitation can spread further.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a formal process mandating rapid patching of actively exploited browser CVEs would have minimized the exposure window for CVE-2026-125350.","CIS Control 2 requires maintaining an inventory of authorized software versions; knowing exactly which Chrome versions are deployed enterprise-wide is a prerequisite for scoping and executing a rapid patch response.","This category requires that once a zero-day vulnerability is disclosed, organizations either mitigate it promptly or formally accept and document the risk, which is exactly the decision point triggered by Google's emergency Chrome update."]