[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz_OzSdqnSC70jQN1Zx8In_HRzWTDbKQbFNbU88MF0EM":3},{"article":4,"iocs":53,"watch_terms":79,"solutions":80,"lesson":175},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"e221ed06-471b-46ea-9d83-68be367bfb95","Google patches eighth Chrome zero-day exploited in attacks this year","google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year-cf90f6","Google has released emergency security updates to patch a new Chrome vulnerability exploited in zero-day attacks, the eighth such flaw since the start of the year. [...]","Google has released an emergency update to fix a Use-After-Free vulnerability in Chrome's XML component, identified as CVE-2026-125350. This marks the eighth zero-day vulnerability exploited in the wild against Chrome this year, highlighting a persistent trend of active exploitation against the browser.","Google patches eighth Chrome zero-day exploited in attacks this year.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgoogle-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F10\u002FChrome.jpg","2026-11-10T08:51:25+00:00","2026-11-10T09:00:17.046457+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Chrome","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},"XML","technology",{"name":27,"type":25},"Use-After-Free",{"name":29,"type":25},"V8 JavaScript engine","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,64,67,70,73,76],{"type":55,"value":56,"context":57},"cve","CVE-2026-125350","New Chrome zero-day vulnerability in XML component.",{"type":55,"value":59,"context":60},"CVE-2026-2441","Iterator invalidation bug in CSSFontFeatureValuesMap.",{"type":55,"value":62,"context":63},"CVE-2026-3909","Out-of-bounds write weakness in Skia 2D graphics library.",{"type":55,"value":65,"context":66},"CVE-2026-3910","Inappropriate implementation vulnerability in V8 JavaScript and WebAssembly engine.",{"type":55,"value":68,"context":69},"CVE-2026-5281","Use-after-free weakness in Dawn (WebGPU standard implementation).",{"type":55,"value":71,"context":72},"CVE-2026-11645","Out-of-bounds read and write vulnerability in V8 JavaScript engine.",{"type":55,"value":74,"context":75},"CVE-2026-87491","Out-of-bounds write flaw in V8 JavaScript engine.",{"type":55,"value":77,"context":78},"CVE-2026-85046","Type confusion flaw in V8 JavaScript engine.",[21,18],{"controls":81,"vendors":169},[82,111,140],{"slug":83,"name":84,"problem":85,"products":86},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":112,"name":113,"problem":114,"products":115},"patch-management","Automated patch management","Known holes get closed in days, not months.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":141,"name":142,"problem":143,"products":144},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[170],{"slug":171,"name":21,"logo_path":172,"roles":173},"google","\u002Fvendor-logos\u002Fgoogle.png",[174],"affected",{"slug":176,"title":177,"body":178,"framework_refs":179,"framework_notes":187},"chromes-eighth-zero-day-of-the-year-underscores-urgent-patch-discipline","Chrome's Eighth Zero-Day of the Year Underscores Urgent Patch Discipline","Google was forced to issue an emergency patch for CVE-2026-125350, a Use-After-Free vulnerability in Chrome's XML component that was actively exploited in the wild — the eighth such zero-day in Chrome this year alone. Use-After-Free flaws allow attackers to execute arbitrary code by manipulating freed memory, making them highly dangerous for browser-based attacks targeting end users. The relentless cadence of Chrome zero-days demonstrates that threat actors are continuously probing widely deployed software for exploitable weaknesses. Organizations that delay browser updates even briefly create windows of opportunity that sophisticated attackers are actively exploiting. Timely, automated patching of end-user software is no longer optional — it is a critical defensive baseline.",[180,181,182,183,184,185,186],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":188,"PCI DSS Requirement 6":189,"NIST SP 800-53 SI-2: Flaw Remediation":190,"OWASP A06:2021 Vulnerable and Outdated Components":191,"CIS Control 7: Continuous Vulnerability Management":192,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":193,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":194},"NIS2 requires entities to implement policies on vulnerability handling and patching as part of their cybersecurity risk management measures, directly mandating the kind of emergency patching process that would address actively exploited browser zero-days.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly, including browser software used to access cardholder data environments, making rapid Chrome patching a compliance obligation.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule; applying this control to end-user browsers would have driven rapid deployment of Google's emergency patch.","Chrome functioning as an outdated component on endpoints mirrors the OWASP risk of running software with known vulnerabilities, emphasizing the need to track and update all client-side software components continuously.","Establishing a continuous vulnerability management process — including tracking vendor advisories and patching on defined timelines — would have ensured Chrome was updated promptly before attackers could exploit CVE-2026-125350 in the wild.","This control mandates timely identification and remediation of technical vulnerabilities, which directly applies to maintaining up-to-date browser software and responding to actively exploited zero-days.","While primarily an access control control, limiting browser privileges and enforcing least-privilege execution contexts would reduce the blast radius of a successful Use-After-Free exploit in Chrome."]