Chromium: Seven High-Severity Vulnerabilities Disclosed Together
Key findings • Seven high-severity vulnerabilities in Google Chrome disclosed November 10-11, 2026. • CVE-2026-125343, a buffer overflow in Compositing, was actively exploited as a zero-day. …
Key findings
- Seven high-severity vulnerabilities in Google Chrome disclosed November 10-11, 2026.
- CVE-2026-125343, a buffer overflow in Compositing, was actively exploited as a zero-day.
- Vulnerabilities affected various components including Compositing, Browser, Skia, Dawn, Extensions, and Layout.
- All vulnerabilities patched in Chrome 157.0.8103.78, with CVE-2026-125343 fixed in 157.0.8103.50.
- Exploitation of CVE-2026-125343 reported by anonymous researcher shortly before patch release.
On November 10-11, 2026, a batch of seven high-severity vulnerabilities affecting Google Chrome was disclosed, impacting various components of the browser. One of these vulnerabilities, CVE-2026-125343, a buffer overflow in Compositing, was reportedly exploited in the wild as a zero-day prior to the patch release.
The vulnerabilities span several areas within Chrome, including Compositing, Browser, Skia, Dawn, Extensions, and Layout. The disclosures highlight potential risks for users who had not yet updated their browsers.
Compositing Vulnerabilities Two distinct vulnerabilities were found in the Compositing component. CVE-2026-125343, a buffer overflow, allowed for remote code execution outside the sandbox. This flaw was addressed in Chrome version 157.0.8103.50. Another compositing vulnerability, CVE-2026-126913, an out-of-bounds read, also posed a risk of memory leakage outside the sandbox. Both required a compromised renderer process and a crafted HTML page to exploit.
Browser and Extensions Vulnerabilities CVE-2026-126902, an incorrect reference resolution in the Browser component, could allow a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Similarly, CVE-2026-126866, an incorrect authorization flaw in Extensions, could be leveraged by an attacker using social engineering to execute arbitrary code within the sandbox through a crafted Chrome extension.
Skia, Dawn, and Layout Vulnerabilities The Skia graphics library was affected by CVE-2026-126894, an out-of-bounds read that could lead to the leakage of cross-origin data. In the Dawn component, CVE-2026-126877, a use-after-free vulnerability, presented a risk of arbitrary code execution outside the sandbox. Additionally, CVE-2026-126854, an incorrect authorization issue in the Layout component, could allow a remote attacker to obtain cross-origin data.
Exploitation and Patching Cyber Security News reported that CVE-2026-125343 was being actively exploited in the wild as a zero-day vulnerability before Google released a patch. The vulnerability was reported by an anonymous researcher on November 6, 2026. Google has not disclosed the extent of the exploitation or the number of targeted users. The affected versions were fixed in Chrome 157.0.8103.50 for Windows and Mac, and 157.0.8103.50 for Linux. The security team stated that details of the bugs would remain undisclosed until a majority of users had applied the update.
Affected Versions and Mitigation All disclosed vulnerabilities were addressed in Google Chrome version 157.0.8103.78, with the exception of CVE-2026-125343, which was fixed in version 157.0.8103.50. Users are strongly advised to update their Chrome browsers to the latest available version to protect themselves from these security risks. The rollout of these updates is ongoing and may take some time to reach all users.
This batch of vulnerabilities underscores the persistent security challenges in complex software like web browsers. The active exploitation of CVE-2026-125343 serves as a critical reminder for users to apply security updates promptly, especially when zero-day threats are involved.