[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feD473LTxwL1G8E2GDMQym9bs-0rz26yr7I22-LvPc8Y":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"490b4401-26a6-4c4c-ad78-e560e2b9d60a","chrome-xml-zero-day-exploited-in-the-wild-eighth-this-year","a2ecf050-3e96-43f3-a5c1-90730c82a47f","Chrome XML Zero-Day Exploited in the Wild — Eighth This Year","Google patched a high-severity zero-day vulnerability (CVE-2026-125350) in Chrome's XML component that was already being actively exploited before a fix was available, making it the eighth Chrome zero-day exploited this year. Zero-day vulnerabilities are particularly dangerous because defenders have no advance warning and no patch to apply at the moment of discovery, leaving users exposed until the vendor releases a fix. The repeated pattern of Chrome zero-days being exploited in the wild underscores that widely used browsers are high-value targets, and organizations that delay browser updates — even by hours — risk compromise. Rapid patch deployment and automated update enforcement are critical controls when zero-days are disclosed alongside active exploitation.","**Immediate actions:**\n- Update all Chrome installations to the latest patched version immediately, prioritizing internet-facing workstations and privileged user devices.\n- Enable Chrome's automatic update mechanism enterprise-wide and verify that browser auto-updates are not blocked by endpoint or network policies.\n- Temporarily consider restricting access to untrusted or high-risk websites via web proxy filtering until the patch has been confirmed deployed across all endpoints.\n\n**Long-term improvements:**\n- Establish an emergency patching SLA (e.g., critical\u002Factively exploited vulnerabilities patched within 24–48 hours) and enforce it with automated compliance reporting.\n- Maintain a complete, up-to-date software inventory including browser versions on all endpoints to enable rapid scoping when new vulnerabilities are disclosed.\n- Implement browser isolation or remote browser isolation (RBI) technology for high-risk users to limit the blast radius of browser-based exploits.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools configured to alert on anomalous browser process behavior, such as unexpected child processes or memory injection patterns.\n- Monitor threat intelligence feeds for indicators of compromise (IOCs) associated with active zero-day exploitation campaigns and push those IOCs to SIEM and EDR platforms immediately.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the repeated exploitation of Chrome zero-days signals that organizations subject to NIS2 must have formal, rapid-response patching procedures for widely deployed software.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying critical security patches within one month of release, a standard that must be tightened to hours when active exploitation is confirmed as in this incident.","SI-2 requires organizations to identify, report, and correct system flaws and install security-relevant software updates within defined timeframes, directly addressing the need for emergency patch deployment when exploitation is confirmed in the wild.","Chrome's XML component represents a third-party software component used at massive scale; this risk category highlights the danger of running outdated or unpatched components and the need to continuously monitor for newly disclosed vulnerabilities in them.","This control mandates establishing a process to continuously acquire, assess, and remediate vulnerabilities; had organizations enforced rapid browser patching cycles, the window of exposure to this actively exploited zero-day would have been minimized.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, including rapid patching, which is precisely what failed for organizations still running unpatched Chrome versions after disclosure.","While primarily an authentication control, enforcing least-privilege browsing environments and restricting which users can run unmanaged browser versions limits the attack surface available to exploit browser zero-days.","published","2026-11-10T07:20:48.621955+00:00","2026-11-10T07:20:48.606+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Fchrome-update-patches-exploited-xml-zero-day-eighth-this-year\u002F","chrome-update-patches-exploited-xml-zero-day-eighth-this-year-eb5d33","Chrome Update Patches Exploited XML Zero-Day, Eighth This Year",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]