[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Chrome Releases blog, Nov 9, 2026: "Google is aware that an exploit for CVE-2026-125350 exists in the wild"); not yet in CISA KEV at publication; bug details restricted

Chrome zero-day: Google patches CVE-2026-125350, a use-after-free in XML with an exploit in the wild, in Chrome 157.0.8103.50/.51

  • Patch: desktop 157.0.8103.50 or later (.51 on some Windows/Mac builds); Extended Stable 156.0.8078.96; Android 157.0.8103.50. Rollout is staged, so force the update and relaunch rather than waiting.
  • Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron apps that bundle Chromium) need their own releases with the fix; check each vendor.
  • The report-to-patch gap was three days, and the bug tracker entry stays restricted until most users update.

Sources: Chrome Releases: Stable Channel Update for Desktop (Nov 9, 2026) · Chrome Releases: Extended Stable Update for Desktop (Nov 9, 2026) · Chrome Releases: Chrome for Android Update (Nov 9, 2026)