MAG212 CYBER ORIGINAL ARTICLE

November 2026 Patch Tuesday: Outlook Leaks NTLM Hashes, Chrome Patches an Exploited Zero-Day

November 14, 2026 · El Mostafa Ouchen

Outlook leaks, Chrome falls: Split diagram: on the left, a crafted Outlook file makes Outlook connect out and leak an NTLMv2 hash; on the right, a crafted web page triggers a Chrome use-after-free inside the sandbox; both are marked as added to KEV o

From the MAG212 CYBER Weekly, 14 November 2026. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was not tested by MAG212; run it only on systems you are authorised to administer.

Status:

  • Outlook CVE-2026-124194: exploited per Microsoft’s CVE record (exploit maturity E:H) and CISA KEV (added 10 Nov, due 24 Nov) [1][2]. MSRC’s page requires JavaScript and could not be read [16].
  • Chrome CVE-2026-125350: confirmed by vendor: “Google is aware that an exploit for CVE-2026-125350 exists in the wild” [20]. Also in KEV (added 10 Nov, due 24 Nov) [1].

What happened — Outlook

Microsoft’s November release fixed about 1,094 CVEs, 63 of them critical, according to CSO and SecurityWeek’s headline. IT-Connect’s headline says 1,093 [14][18][19]. The only exploited zero-day was CVE-2026-124194, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R, C:H). When a user opens a crafted file, Outlook connects to an attacker-controlled location without the usual external-content warning, which discloses the user’s NTLMv2 hash. The hash can then be relayed or cracked offline [14]. eSecurityPlanet describes the file as a “specially crafted message file”, while CSO says “malicious Office file”. Microsoft says the Preview Pane is not an attack vector [15]. CSO reports Microsoft credited “an Anthropic researcher using Claude”; that is single-sourced [14].

What happened — Chrome

On Monday 9 November Google shipped Chrome 157.0.8103.50/.51 (Windows, Mac) and 157.0.8103.50 (Linux). The release fixes CVE-2026-125350, a high-severity use-after-free in XML handling, reported by Arni Hardarson (Neonix Security) and an anonymous researcher [20]. The CVE record says it allows code execution “inside the sandbox via a crafted HTML page” (ADP CVSS 8.8) [2]. KEV notes that Chromium-based Edge and Opera are also affected [1]. Ivanti’s Chris Goettl calls it Chrome’s eighth zero-day of 2026 [14]. Other outlets’ headlines say “fifth”, possibly about a different bug, so the count is unverified.

Who is affected

ProductFixed version / route
Office LTSC 2021 (Outlook)16.0.14334.21048 [2]
Office LTSC 2024 (Outlook)16.0.17932.21140 [2]
Microsoft 365 Apps for EnterpriseVia aka.ms/OfficeSecurityReleases [2]. The 10 Nov builds include Current Channel 2610 (20527.20196); Monthly Enterprise 2610 (20527.20194), 2609 (20430.20264), 2608 (20326.20320); Semi-Annual Enterprise 2610 (20527.20192), 2609 (20430.20262), 2608 (20326.20318). Microsoft’s page does not label which builds carry this fix [17].
Google Chrome157.0.8103.50/.51 (Win/Mac), 157.0.8103.50 (Linux) [20]
Edge, Opera (Chromium-based)Affected per KEV. Apply the vendor’s update [1].

Why this matters

Two exploited client bugs landed in the same week as one of the largest Patch Tuesdays on record. An Outlook flaw that leaks NTLMv2 hashes turns ordinary mail handling into credential theft, and a Chrome zero-day reaches every user who browses. Patch order and forced restarts matter more than the raw CVE count. (MAG212 analysis)

Split diagram: on the left, a crafted Outlook file makes Outlook connect out and leak an NTLMv2 hash; on the right, a crafted web page triggers a Chrome use-after-free inside the sandbox; both are marked as added to KEV on 10 November.
Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.

How the attack works

  • Outlook:
    • The attacker delivers a crafted message or Office file.
    • The user opens it. Preview alone does not trigger the flaw.
    • Outlook silently connects to an attacker-controlled network location.
    • The NTLMv2 challenge-response goes to the attacker.
    • The attacker relays or cracks it offline.
    • Unknown: campaign, actor, targeting.
  • Chrome: the user visits a crafted HTML page, which triggers the use-after-free and code execution inside the renderer sandbox. Unknown: sandbox-escape partner bug, campaign and actor.

What defenders should look for

  • Outlook:
    • message or Office attachments from external senders followed by a file-open event
    • outbound connections from the Outlook process to external hosts that are not mail or Microsoft infrastructure
    • outbound authentication attempts to the internet

The sources do not name the protocol. SMB/TCP 445 and WebDAV are the usual NTLM-leak channels, but that is MAG212 inference. Watch for later sign-ins from unusual locations using the affected account. False positives: some business workflows legitimately exchange .msg files. A received attachment is weaker evidence than an open event followed by an outbound connection.

  • Chrome: browser crash telemetry clustered around a single site, and browser versions below 157.0.8103.50 in your inventory.

How to investigate

Build a timeline from message trace, attachment provenance, endpoint file-open telemetry, and proxy or firewall logs. Click-to-Run Office updates do not appear as Windows hotfixes, so confirm Outlook remediation by the Office build number per channel, not by OS patch compliance (MAG212 inference from [17]).

Contain and remediate (in order)

  1. Deploy the November Office security update for each channel.
  2. Update Chrome, Edge and Opera, and force a browser restart.
  3. Block outbound SMB to the internet at the perimeter (MAG212 guidance).
  4. Where exposure is evidenced, reset the affected user’s password and revoke sessions from a clean device.
  5. Then work through the rest of Patch Tuesday. CSO flags these CVSS 9.8 items [14]:
    • CVE-2026-119958: Windows LDAP RCE, unauthenticated; domain controllers at risk.
    • CVE-2026-118207: Exchange Server RCE, triggerable by anyone who can send mail to the organisation.
    • CVE-2026-112967: Xbox Live Networking RCE (adjacent network).
    • CVE-2026-119990: Azure OpenAI elevation of privilege (cloud, auto-mitigated).

eSecurityPlanet adds a critical Windows Search/Exchange attachment RCE (CVE-2026-116928) and Message Queuing RCEs (CVE-2026-119963, CVE-2026-119964) [15].

Verify recovery

Compare each Outlook build with the fixed build for its channel. Check that browser inventory shows 157.0.8103.50 or later.

Prevention and awareness

Teach staff not to open unexpected message-file attachments, and to verify them through a known channel. Restrict NTLM where it is operationally feasible, after testing in staging.

No command panels. Microsoft’s MSRC FAQ and any PowerShell or Exchange cmdlet documentation were not verified this week [16].

Related on MAG212 CYBER

Sources

  1. [1] CISA (GitHub mirror), “Known Exploited Vulnerabilities catalog JSON, catalogVersion 2026.11.13”, 13 Nov 2026, 20:24 UTC. link
  2. [2] CVE Program, “cvelistV5 CVE JSON 5 records (CVE-2026-123039, -124194, -125350, -123158, -6460 and others)”, Various, Nov 2026. link
  3. [14] CSO Online, “November 2026 Patch Tuesday: 63 critical Microsoft fixes plus an Outlook zero-day that allows theft of hashed credentials”, 10 Nov 2026. link
  4. [15] eSecurityPlanet, “Microsoft November 2026 Patch Tuesday: Outlook zero-day”, 11 Nov 2026. link
  5. [16] Microsoft MSRC, “CVE-2026-124194 Security Update Guide entry (JavaScript-only; not readable)”, 10 Nov 2026. link
  6. [17] Microsoft Learn, “Update history for Microsoft 365 Apps (by date)”, Entries dated 10 Nov 2026. link
  7. [18] SecurityWeek, “Exploited Outlook zero-day among 1,094 flaws patched by Microsoft (headline only; page not readable)”, Nov 2026. link
  8. [19] IT-Connect, “Patch Tuesday November 2026: Microsoft fixes 1,093 vulnerabilities (not fetched)”, Nov 2026. link
  9. [20] Google Chrome Releases, “Stable Channel Update for Desktop”, 9 Nov 2026. link

Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.