Attackers exploit Chrome XML memory flaw to run code through malicious web pages

What happened

A flaw in the XML component of Google Chrome lets a remote attacker run code of their choice when a victim opens a specially built web page. The bug is a use-after-free: the browser keeps using a piece of memory after it has been released, and an attacker can steer what ends up there.

The code runs inside Chrome's sandbox, which limits what it can reach on the computer. Google rates the issue High in its own Chromium severity scale.

The flaw is already being used in attacks. CISA added it to its Known Exploited Vulnerabilities catalog on 10 November 2026, the same day the CVE was published.

Who is affected

Google Chrome versions before 157.0.8103.50 are affected. Google has fixed the problem in its desktop stable channel update. Anyone using an older Chrome build is exposed when browsing to a malicious page.

How serious is it

The flaw carries a CVSS score of 8.8, rated high. An attacker needs no account or prior access, only a user who visits the wrong page. Successful attacks can compromise the confidentiality, integrity and availability of data the browser handles.

Active exploitation and the CISA listing make this a patch-now issue. The sandbox limits the damage on its own, but attackers often pair such bugs with a second flaw to break out of it.

What you should do

1. 1Update Google Chrome to version 157.0.8103.50 or later on all systems.
2. 2Restart Chrome after the update so the fixed version is actually running.
3. 3Check managed fleets for machines still on older Chrome builds.
4. 4US federal agencies must apply the vendor's fix by 24 November 2026, or stop using the product if they cannot.

Quick facts