Outlook and Chrome, two flaws already exploited: the November updates to install now

Between 9 and 10 November 2026 Google and Microsoft fixed two vulnerabilities that, according to the vendors themselves, were already being exploited in real attacks: one in Microsoft Outlook (CVE-2026-124194) and one in Google Chrome (CVE-2026-125350). On 10 November the US agency CISA added both to its catalog of exploited vulnerabilities.

Outlook and a browser are on the computers of almost every office. For a Ticino SME the message is practical: these two updates should not wait for the next random restart; they should be installed and checked this week.

Outlook: a message file that leaks credentials

According to Microsoft’s advisory, an attacker can send a specially crafted message file and convince the user to open it in Outlook. When opened, Outlook can connect to a network location controlled by the attacker without showing the usual external-content warning. This can expose the user’s NTLMv2 hash, a fingerprint of their Windows credentials that can be used to authenticate as them.

• Official severity: CVSS 3.1 of 6.5, “moderate” for Microsoft. The score is limited because user action is required, but the flaw is already exploited and Microsoft states that customer action is required.
• Preview Pane: according to Microsoft it is not an attack vector; the file has to be opened.
• Affected products: Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024.

Fixed versions listed by Microsoft:

Chrome: one web page and the browser is compromised

On 9 November Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, with nine security fixes. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild. It is a memory-handling bug in the XML component: according to the official description, a crafted HTML page can run code inside the browser sandbox. NVD lists a CVSS score of 8.8.

Other Chromium-based browsers are affected too. For Microsoft Edge, at the time of publication Microsoft’s security release notes say a fix is being prepared: install it as soon as it is available.

What about Windows servers?

Microsoft’s November release contains fixes for more than a thousand vulnerabilities. Apart from Outlook, none is reported as exploited, but some have very high scores: for example CVE-2026-119958 in the Windows LDAP service (CVSS 9.8, no credentials needed), relevant for domain controllers. Microsoft rates exploitation as “less likely”. Anyone running a Windows server in the office should still schedule the November updates soon.

What to do this week

1. Update Office on every computer with Outlook. In Outlook: File, Office Account, Update Options, Update Now. Then compare the build number with the table above, or ask your IT provider.
2. Update Chrome and relaunch it. Help menu, About Google Chrome, then Relaunch. A browser left open for days does not apply the update.
3. Keep an eye on Edge and other Chromium browsers (Brave, Opera, Vivaldi) and install the fix as soon as it ships.
4. Warn your staff. Do not open unexpected message files or Office attachments, even when the sender looks familiar. Phishing remains the most common way in, as we saw with fake hotel bookings.
5. Ask your IT provider whether SMB traffic to the internet is blocked at the firewall: it is a general defence against NTLM credential leaks.
6. Strengthen logins. If credentials are exposed, multi-factor authentication limits the damage: see the five levels of login security.

We do not publish details on how to exploit these flaws: the goal is to update and verify. For last month’s exploited flaws see also our end-of-October roundup.

If an account was compromised: reporting

• Change the password immediately for the affected account and check sign-ins and forwarding rules in the mailbox.
• Data protection (FADP). If personal data was exposed and the breach is likely to result in a high risk for the people concerned, article 24 of the Federal Act on Data Protection requires notifying the FDPIC as soon as possible. The FDPIC guidelines help assess the case.
• NCSC. For most SMEs reporting to the National Cyber Security Centre is voluntary but useful. Operators of critical infrastructure, however, have a reporting obligation for cyberattacks within 24 hours of discovery.

Frequently asked questions

We use Outlook on the web or on our phones: are we affected?

Microsoft’s advisory lists only the Office desktop applications (Microsoft 365 Apps, Office LTSC 2021 and 2024). Anyone who also uses Outlook on Windows must update it.

Microsoft 365 updates itself: can we just wait?

Usually yes, but it depends on the update channel and on the application being closed and reopened. It is worth checking the build number at least on the most exposed computers, such as those in accounting or management.

Chrome says it is up to date, but the version is old: why?

Google rolls updates out gradually. Opening the About Google Chrome page makes the browser look for the update immediately; then it has to be relaunched.

Our approach

ElaraTeq Sagl helps SMEs and practices in Ticino manage updates, configure mail and workstations securely and raise staff awareness (consulting, hosting in Switzerland). To have your setup checked you can contact us.

Sources

• Microsoft, CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 November 2026
• Microsoft, Release notes for Microsoft 365 Apps security updates
• NIST NVD, CVE-2026-124194 and CVE-2026-125350
• CISA, Known Exploited Vulnerabilities Catalog (additions of 10 November 2026)
• Google, Stable Channel Update for Desktop, 9 November 2026
• Microsoft, Release notes for Microsoft Edge Security Updates
• Microsoft, CVE-2026-119958, Windows LDAP Remote Code Execution Vulnerability
• NCSC, Reporting obligation for cyberattacks on critical infrastructure
• FDPIC, Guidelines on data breaches