Summary

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek .

For more information, read the full story at the original source: SecurityWeek ↗

Vulnerabilities in this story

• CVE-2026-11645 KEV · fix by 2026-06-23 Google Chrome EPSS 2.4% 8.8High
• CVE-2026-2441 KEV · fix by 2026-03-10 Google Chrome EPSS 54.4% 8.8High
• CVE-2026-3909 KEV · fix by 2026-03-27 Google Chrome EPSS 2.3% 8.8High
• CVE-2026-3910 KEV · fix by 2026-03-27 Google Chrome EPSS 2.6% 8.8High
• CVE-2026-5281 KEV · fix by 2026-04-15 Google Chrome EPSS 13.7% 8.8High
• CVE-2026-85046 KEV · fix by 2026-09-18 Google Chrome EPSS 1.8% 8.8High
• CVE-2026-87491 KEV · fix by 2026-09-23 Google Chrome EPSS 3.5% 8.8High

Also reported by

• The Hacker News: Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 ↗
• Security Affairs: Google fixes the eighth actively exploited Chrome zero-day of 2026 ↗
• BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year ↗