MAG212 CYBER ORIGINAL ARTICLE

Chrome Zero-Day, Cisco BroadWorks and Openwave Join CISA KEV With a 24 November Deadline

November 11, 2026 · El Mostafa Ouchen

MAG212 CYBER illustration: a browser window with a red warning badge beside telecom and messaging tiles, headline 'Chrome zero-day leads the rest of the KEV batch'.

CISA’s 10 November additions to the Known Exploited Vulnerabilities catalog did not stop at Barracuda and Outlook. Three more actively exploited flaws went in on a 14-day clock: a use-after-free in Chrome that Google confirms is exploited in the wild, an XML external entity bug in Cisco BroadWorks that can expose configuration to an unauthenticated attacker, and a flaw in Openwave’s Webtop Media Transcoder. All three are due on 24 November.

Chrome CVE-2026-125350: exploited XML use-after-free

[Reported] Google is “aware that an exploit for CVE-2026-125350 exists in the wild”. Reported anonymously on 6 November, it is the eighth exploited Chrome zero-day of 2026, fixed in Chrome 157.0.8103.50/.51 (Windows, macOS) and 157.0.8103.50 (Linux). (The Hacker News) (SecurityWeek) [Confirmed] KEV notes it affects other Chromium browsers such as Edge and Opera. (CISA KEV) [Unknown] Attack details, targets, IOCs, and whether Edge has shipped a fix; Google’s release note was not opened. Do [MAG212 analysis] push 157.0.8103.50/.51 and force a browser restart, then track Edge and Opera. Verify the version in your endpoint inventory.

Gantt chart of fifteen KEV entries between 27 October and 24 November 2026, with 11 November marked as today.
Figure 4 · KEV clocks running this week. Each bar runs from the date CISA added the flaw to KEV to the federal due date. The two Barracuda entries (red) have three days and a forensic-triage flag. Diagram: MAG212 CYBER

Cisco BroadWorks CVE-2026-20320: exploited XXE

[Confirmed] An XML external entity flaw that “could allow an unauthenticated, remote attacker to read sensitive configuration information”; due 24 November. (CISA KEV) [Unknown] Fixed releases, CVSS and IOCs; read Cisco’s advisory (not opened) before acting. [MAG212 analysis] Configuration can hold credentials, so plan rotation alongside the patch.

Openwave Webtop Media Transcoder CVE-2026-111793

[Confirmed] “Incorrect resource transfer between spheres” in Openwave Messaging Webtop Media Transcoder; due 24 November, referencing the vendor’s GitHub advisory and JVN. (CISA KEV) (Openwave) [Unknown] Versions and exploitation details. Narrow audience: telecom and messaging providers.

[MAG212 analysis] Where we recorded the flag, every three-day KEV deadline this week carries forensic triage “Yes” and every 14-day one “No”: the short clock appears to signal suspected compromise, not just urgency.

Why it matters

Chrome is on almost every endpoint, and Chromium-based browsers such as Edge and Opera inherit its bugs until their own vendors ship fixes. BroadWorks runs voice and unified communications for many service providers, and its configuration can hold credentials. Telecom platforms are a favourite target of espionage groups, as today’s CopperDragon story shows.

The bottom line

Force Chrome 157.0.8103.50/.51 with a browser restart and track Edge and Opera, read Cisco’s BroadWorks advisory and plan credential rotation alongside the patch, and if you run Openwave Webtop, apply the vendor’s fix before the 24 November deadline.

How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.

This story is part of MAG212 CYBER Daily, 11 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. By El Mostafa Ouchen.