Chrome Patches Exploited XML Zero-day
Chrome patches nine flaws, including an exploited XML issue; Palo Alto Networks and Atlassian report separate vulnerabilities.
Google issued Chrome 157 updates patching nine vulnerabilities, including a high-severity use-after-free in the XML component exploited in the wild. SecurityWeek reports this is the eighth Chrome zero-day exploited this year.
Context
Palo Alto Networks says a buffer overflow in GlobalProtect App during Portal/Gateway processing could allow a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges; the company reports no known exploitation. Atlassian says CVE-2026-90436 allows remote code execution in Confluence Data Center via Apache Axis used in the XML-RPC and SOAP Remote API, which must be enabled.
“Separately, Palo Alto Networks says a GlobalProtect App buffer overflow during Portal/Gateway processing could allow a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges.”
Zeno Khosla
Skeptical perspective
SitRep’s judgement from the cited reporting, not reported fact. Written by AI.
Sources Report Different Exploitation Status
SecurityWeek reports the Chrome XML issue was exploited in the wild and was the eighth Chrome zero-day exploited this year. Palo Alto Networks reports no known exploitation of the GlobalProtect App issue.
SecurityWeek · Palo Alto Networks Security Advisories