[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0rAA-uBrqDMfc97c2Dilogm-zhYTT17RDCsvBsl2xj4":3},{"article":4,"iocs":49,"watch_terms":69,"solutions":70,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"c6f18aa8-2215-4d8c-a82b-edcbc823ce40","Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026","google-issues-chrome-security-update-for-eighth-actively-exploited-zero-day-of-2-749cd7","Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N\u002FA), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after","Google has released an update for Chrome to address nine security vulnerabilities, including one zero-day (CVE-2026-125350) that is being actively exploited in the wild. This use-after-free bug in the XML component could lead to data corruption or arbitrary code execution. This marks the eighth actively exploited zero-day vulnerability patched in Chrome this year.","Google Chrome patched its eighth actively exploited zero-day vulnerability of 2026.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fgoogle-issues-chrome-security-update.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhjk5S9J891bQS8W6TgyoiEPQ7geGia8FqqWjckFlo9qMH2wXIXv-7gyod1XKUpI9BfgcliN2Re8A85rJ121jxqgfnw1LsjYBvAYtX7694GVgMF7B94G0n5MzqMaKqLAbr-No1nqrN0gyF8MFR_bYQIYlqiTh_FzobmWrq4NOCLbcW_78uEMMW5FE4eqJoo\u002Fs1600\u002Fchrome-0day.jpg","2026-11-10T06:52:54+00:00","2026-11-10T08:00:19.954439+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Chrome","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":19},"Microsoft Edge",{"name":26,"type":19},"Brave",{"name":28,"type":19},"Opera",{"name":30,"type":19},"Vivaldi","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,59,61,63,65,67],{"type":51,"value":52,"context":53},"cve","CVE-2026-125350","Actively exploited use-after-free vulnerability in Chrome's XML component.",{"type":51,"value":55,"context":56},"CVE-2026-2441","Previously patched actively exploited Chrome zero-day.",{"type":51,"value":58,"context":56},"CVE-2026-3909",{"type":51,"value":60,"context":56},"CVE-2026-3910",{"type":51,"value":62,"context":56},"CVE-2026-5281",{"type":51,"value":64,"context":56},"CVE-2026-11645",{"type":51,"value":66,"context":56},"CVE-2026-85046",{"type":51,"value":68,"context":56},"CVE-2026-87491",[21,18,24],{"controls":71,"vendors":159},[72,101,130],{"slug":73,"name":74,"problem":75,"products":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":102,"name":103,"problem":104,"products":105},"patch-management","Automated patch management","Known holes get closed in days, not months.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":131,"name":132,"problem":133,"products":134},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[160],{"slug":161,"name":21,"logo_path":162,"roles":163},"google","\u002Fvendor-logos\u002Fgoogle.png",[164,165],"reported_by","affected",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"chromes-eighth-zero-day-of-2026-highlights-urgent-patching-demand","Chrome's Eighth Zero-Day of 2026 Highlights Urgent Patching Demand","A use-after-free vulnerability in Chrome's XML component (CVE-2026-125350) is being actively exploited in the wild, allowing attackers to corrupt data or execute arbitrary code on unpatched systems. This is the eighth actively exploited Chrome zero-day patched in 2026 alone, signaling that browser vulnerabilities are a persistent and high-frequency attack vector. Organizations that delay browser updates — even by days — expose users to real-world exploitation, since threat actors move quickly once a zero-day is known. The sheer volume of Chrome zero-days this year underscores the need for automated, rapid patch deployment rather than relying on manual update cycles.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":179,"PCI DSS Requirement 6":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including rapid response to actively exploited vulnerabilities like this Chrome zero-day.","Requirement 6 mandates that organizations protect systems and software against known vulnerabilities by installing applicable security patches, making timely Chrome updates a compliance obligation for in-scope environments.","SI-2 requires organizations to identify, report, and correct information system flaws, and to install security-relevant updates within defined time frames — directly applicable to deploying this Chrome patch rapidly.","Running an unpatched version of Chrome is a textbook instance of using a vulnerable component; OWASP A06 highlights the risk of failing to track and update third-party software like browsers.","Regularly scanning for and remediating known vulnerabilities — especially actively exploited ones — would have ensured Chrome was patched before attackers could leverage CVE-2026-125350.","This control mandates timely identification and remediation of technical vulnerabilities, which would have driven prompt application of Google's security update before active exploitation impacted users.","While primarily an access control control, limiting browser use to managed, fully patched endpoints with enforced update policies reduces the attack surface exposed by zero-days targeting end-user applications."]