Google Patches Eighth Chrome Zero-Day of 2026: CVE-2026-125350 Use-After-Free Exploited in the Wild
Google has issued an emergency update for Chrome that closes a zero-day vulnerability already leveraged in active attacks. This is the eighth such 0-day patched by the company in 2026.
The vulnerability, identified as CVE-2026-125350, received a high severity rating. It is a use-after-free flaw in the XML processing component, where the browser attempts to access memory after it has been freed. Such errors can enable memory corruption and allow attackers to execute malicious code on affected systems.
An anonymous researcher disclosed the issue to Google on November 6. The company confirmed that working exploits exist but has not released information about the threat actors, their targets, or the scale of the campaign.
The update is available in the stable desktop channel with the following versions: Windows and macOS — 157.0.8103.50/.51, Linux — 157.0.8103.50. In total, the release addresses nine vulnerabilities, including additional issues in V8, WebGL, GPU, and the file system.
Google is limiting disclosure of technical details until a larger portion of users have applied the patches. Users can check for the update via Chrome → Help → About Google Chrome and must restart the browser after installation.
Related articles
Pentester Shares Experience Mistaking HTTP 500 Response for Remote Code Execution on Live React and Node.js Application
A security researcher published an account of their first real-world penetration test on a live website built with ReactJS and Node.js. On the fourth day of testing, the author encountered an HTTP 500 error that initially appeared consistent with a successful remote code execution attempt. The article describes the researcher's process of investigating the response and realizing the error was unrelated to code execution. The post highlights common pitfalls when interpreting server responses during active assessments. It also notes the use of standard web technologies and the researcher's intent to share lessons from the engagement. The publication is presented as a case study from the Habr platform.
Apple Patches iMessage Group Chat Flaws Allowing Remote Attackers to Join Conversations
Apple has released security updates addressing multiple vulnerabilities that could allow unauthorized access to iMessage group chats. The fixes cover two specific issues tracked as CVE-2026-113961 and CVE-2026-113960, both discovered by an anonymous researcher. One flaw stemmed from insufficient authorization checks, while the second involved vulnerable code that could expose prior messages to new participants. Patches are included in iOS and iPadOS 27.2.1 as well as version 26.7.3. Additional fixes address Bluetooth pairing bypasses, AirPlay restrictions, and a memory corruption issue in the Brotli compression library. Apple has not confirmed any in-the-wild exploitation of these bugs.
Top 5 Cybersecurity Events of the Week: Barracuda Root Exploits, cPGuard Supply-Chain Attack, APT Flaw, Xen Escape Bugs, and OpenSSH Authentication Bypass
This week’s Jet CSIRT roundup highlights five critical security issues affecting widely deployed infrastructure. Two high-severity vulnerabilities in Barracuda Email Security Gateway and other appliances allow unauthenticated attackers to obtain root access via authorization bypass and command injection. A supply-chain compromise of cPGuard versions 5.88.12–5.88.19 enabled theft of password hashes, database files, and SSH keys from at least 32 customer servers before the malicious update was removed. A flaw in the APT package manager (CVE-2026-109518) lets network attackers substitute malicious packages that execute with root privileges on Debian and Ubuntu systems. Two Xen hypervisor bugs (CVE-2026-102703 and CVE-2026-102704) permit a compromised guest VM to read and write memory belonging to dom0 and other guests. Finally, an OpenSSH authentication bypass on musl-based Alpine Linux distributions allows passwordless login to key-only accounts when long password hashes trigger a crypt() return value of “*”.
CISA and FBI Warn of Global Cyber Attacks on Industrial Refrigeration and Cold Chain Controllers
CISA, the FBI, and multiple U.S. agencies issued a joint advisory on November 5 detailing malicious cyber activity targeting industrial refrigeration systems and cold chain monitoring equipment worldwide. Attackers are exploiting unpatched or internet-exposed temperature controllers in supermarkets and cold storage facilities through authentication bypass, arbitrary code injection, and weak configurations. Once inside the control panels, threat actors force units into continuous heating and defrost cycles, the opposite of their intended function, while also causing denial of visibility that prevents operators from seeing real equipment status. The advisory highlights risks including reduced system lifespan, fire hazards, stock loss, and potential consumer harm from spoiled products stored outside safe temperature ranges. Sectors most affected include public health, chemical manufacturing, food and agriculture, and refrigerated transportation. Recommended mitigations focus on network segmentation, removal of remote access from the public internet, strong authentication, firmware updates, and regular offline backups.