Google released a Chrome security update on Monday addressing nine vulnerabilities, one of which is a high-severity use-after-free flaw in the browser's XML component that Google's advisory says is already being exploited in the wild.
The flaw carries the identifier CVE-2026-125350. Its CVSS score is listed as N/A — the base score has not yet been assigned. Administrators running vulnerability-management tooling should note that an N/A score means the rating is pending, not that the issue scores zero; the exploitation status, not a numerical rating, is the operative signal here.
The Hacker News, which reported the release on 10 November, characterised it as the eighth actively exploited zero-day of 2026. Google's advisory itself states only that the XML use-after-free is under active exploitation in the wild. Either framing points to the same operational response: patch now, ahead of any score assignment.
Why it matters
Use-after-free bugs occur when software reads or writes a memory location that has already been released — and can then be repurposed by an attacker. In a browser, that class of memory-corruption bug is a favoured route to remote code execution, which is precisely why an exploited instance attracts urgent patching rather than a routine update cycle.
The broader signal is tempo. If eight exploited zero-days have landed in a single year, the takeaway for IT teams is not any single CVE but the argument for continuous, automated browser patching rather than ad-hoc firefighting after each advisory.
A patch-rollout checklist for IT admins
The following checklist reflects standard deployment practice rather than a procedure prescribed by Google:
- Confirm your fleet's current Chrome build across desktops, VDI images, and any golden images, and compare against the latest stable release Google has published.
- Prioritise internet-facing and high-privilege endpoints for the update window; browser exploitation needs only a visit to a malicious or compromised page.
- Restart browsers to complete the update — a patch that has downloaded but not applied leaves the flaw exposed.
- Verify Chromium-based derivatives separately. Alternative browsers built on Chromium ship their own releases on their own schedules; check each vendor's advisory rather than assuming Chrome's fix has propagated. A fix listed in a vendor's release notes does not necessarily mean your deployment is patched — vendors roll shared-component fixes into their own builds at different paces, so treat the release note as the start of the check, not the end of it.
- Re-check deployment after the window closes, and log exceptions so unpatched machines are visible rather than silently outstanding.
No Hong Kong-targeted activity is reported in the available material on this issue. Organisations here should nonetheless treat the update as time-sensitive, since exploitation of browser flaws does not require the victim to be specifically selected.
Google's advisory and The Hacker News report are the references for this story; neither published details on the remaining eight flaws nor on the discoverer credited with CVE-2026-125350.
Google 於星期一發布 Chrome 安全更新，修補九項漏洞，其中一項是瀏覽器 XML 元件中的高風險 use-after-free 漏洞，Google 的安全公告指出，該漏洞已在野外遭實際利用。
該漏洞的識別編號為 CVE-2026-125350。其 CVSS 評分列為 N/A——基本評分尚未指派。使用漏洞管理工具的管理員須注意，N/A 代表評分仍在待定，而非代表該問題得零分；此處的關鍵指標是漏洞是否已被利用，而非數字評分。
The Hacker News 於 11 月 10 日報導此次發布，將其形容為 2026 年第八個遭實際利用的 zero-day。Google 的安全公告本身則僅表示該 XML use-after-free 漏洞正於野外遭主動利用。兩種說法指向同一個營運層面的應對：立即修補，毋須等待評分指派。
為何值得關注
Use-after-free 漏洞出現於軟體對已被釋放的記憶體位置進行讀取或寫入之時——該記憶體其後可被攻擊者重新利用。在瀏覽器中，此類記憶體損壞漏洞是達成遠端執行程式碼（remote code execution）的常見途徑，正因如此，一個已被利用的漏洞會引發緊急修補，而非納入例行更新周期。
更宏觀的訊號是速度。若一年內已出現八個遭利用的 zero-day，IT 團隊的啟示不在於任何單一 CVE，而在於應持續、自動化地修補瀏覽器，而非在每份公告發布後臨時救火。
IT 管理員修補部署清單
以下清單反映標準部署實務，並非 Google 規定的程序：
- 確認所有端點目前的 Chrome 版本，涵蓋桌面電腦、VDI 映像及任何 golden image，並與 Google 最新發布的 stable 版本作比較。
- 優先處理對外連線及高權限端點的更新時段；瀏覽器漏洞利用只需受害人瀏覽一個惡意或已被入侵的網頁。
- 重新啟動瀏覽器以完成更新——修補程式雖已下載但未套用，漏洞仍然暴露。
- 另行查核基於 Chromium 的衍生瀏覽器。這些替代瀏覽器各自按自身節奏發布版本；應逐一查閱各廠商的安全公告，而非假設 Chrome 的修復已自動傳播。在廠商 release notes 中看到某項修復，並不一定等於你的部署已獲修補——各廠商將共用元件的修復整合至自身版本的進度不一，因此應把 release notes 視為查核的起點，而非終點。
- 時段結束後再次檢查部署情況，並記錄例外情況，令未修補的機器一目了然，而非默默擱置。
就目前可得資料而言，未有針對香港的相關攻擊活動報導。惟本港機構仍應將此次更新視為具時限性，須限期處理，因為瀏覽器漏洞的利用並不需要受害人被特定挑選。
Google 的安全公告及 The Hacker News 的報導為本文參考資料；雙方均未披露其餘八項漏洞的詳情，亦未交代獲認定為 CVE-2026-125350 發現者的資料。