Threat feed

HighCVSS8.8#CVE-2026-125350 #Google Chrome #Chromium #use-after-free #browser #zero-day #KEV

CVE-2026-125350 — Google Chrome XML use-after-free exploited in the wild: explainer and fix (fixed in 157.0.8103.50, listed in KEV)

CVE-2026-125350 is a use-after-free in XML in Chrome before 157.0.8103.50. Google says an exploit exists in the wild. In CISA KEV, due 24 November.

Published 2026-11-11 Updated 2026-11-11 Last verified 2026-11-11 7 min read

On this page

An explainer for a Google Chrome vulnerability that can be triggered by opening a crafted web page. It covers what happens, the affected and fixed versions and what individuals and administrators should do, from the defender's side and without attack steps.

Advisory summary — ADVISORY / KEV

CVE: CVE-2026-125350 (Chromium issue 582442907)
Severity: Chromium severity High. CVSS v3.1 8.8 (AV:N/AC:L/PR:N/UI:R; assigned by CISA's ADP)
Type: Use-after-free in XML (CWE-416). Arbitrary code execution inside the sandbox
Affected: Google Chrome before 157.0.8103.50 (CVE record). KEV says it may affect Chromium-based browsers such as Edge and Opera
Fix: Chrome Stable 157.0.8103.50 (Windows and Mac 157.0.8103.50/.51, Linux 157.0.8103.50)
Dates: Chrome Releases post: 9 November 2026. CVE record published 10 November
Exploitation: Google says it is aware of an exploit in the wild. Added to CISA KEV on 10 November (due 24 November)

Exploited

Per Google

8.8

CVSS v3.1 (CISA ADP)

157.0.8103.50

Fix (Windows and Mac also .51)

24 Nov

KEV due date

Risk of waiting

This kind of flaw can give an attacker a foothold from nothing more than a page view. Code execution inside the sandbox is not a full takeover of the device, but browser attacks typically use it as a first stage that is chained with other flaws. Whether that happened with this CVE cannot be confirmed from public information.

What the vulnerability is

The CVE record describes a use-after-free (use of memory after it was freed) in the XML component of Chrome before 157.0.8103.50. A remote attacker could execute arbitrary code inside the sandbox through a crafted HTML page. In Google's release notes the severity is High, the reporter is anonymous and the report date is 6 November 2026.

The user has to open the crafted page (UI:R in the CVSS vector).
Neither Google nor this site publishes attack steps or code.
Google notes that bug details may stay restricted until most users have updated.

The same update also fixes another XML use-after-free (CVE-2026-125346), but Google mentioned an in-the-wild exploit only for CVE-2026-125350. In total the update carries 9 security fixes.

Who is affected

Item	Detail
Product	Google Chrome (desktop)
Affected versions	Before 157.0.8103.50 (CVE record)
Fix (Stable)	Windows and Mac: 157.0.8103.50/.51. Linux: 157.0.8103.50
Other Chromium-based browsers	KEV says Edge, Opera and others may be affected. Each vendor ships its own fix
Microsoft Edge	At the time of checking, Microsoft's security release notes did not list a version that includes this CVE, so no version number could be confirmed. A 9 November notice says Microsoft is aware of exploits in the wild and is preparing a fix (no CVE named)
Workaround	None listed. Updating is the remedy

Google says the rollout takes days to weeks. You do not need to wait for it to reach you; you can check manually.
The desktop Stable post does not cover Android or iOS. If you use those, check the store for updates.

How to check whether you are affected

Check the Chrome version

Open chrome://settings/help (menu, Help, About Google Chrome). Below 157.0.8103.50 means affected. Opening this page also starts the update check and download.

See whether a relaunch is pending

Once the update is downloaded, a Relaunch button appears. The fix is not active until you relaunch. Machines kept running for days with many tabs open are the ones to watch.

Check other browsers

If you use Edge, Opera or another Chromium-based browser, check the update from its About page. Each vendor's fixed version comes separately, and none could be confirmed at the time of writing (Asset inventory checklist).

What to do today

Update Chrome and relaunch (top priority)

Open About Chrome to fetch the update and press Relaunch. Save work in open tabs and forms first. After the restart, check the version again: it should be 157.0.8103.50 or later.

Update Edge, Opera and other Chromium-based browsers

Check each browser for updates and install the latest. While a fix is not yet available, this site's own suggestion is to avoid untrusted sites and remove unneeded extensions to reduce exposure. That is not a substitute for updating.

(Administrators) List the versions in your fleet

Use the admin console or your asset tool to find devices on Chrome below 157.0.8103.50. Remote workers and machines that rarely restart are the ones most likely to be left behind.

(Administrators) Force the update and relaunch

Check for policies that block updates or pin a version, and remove them. Chrome has relaunch-notification policies (such as RelaunchNotification) that you can set with a deadline. The KEV due date is 24 November. The process is laid out in The vulnerability remediation playbook.

Afterwards, look for unusual behaviour

For the period before the update, check for extensions you do not recognise, changed home page or search engine, and unusual access to saved passwords. If you find any, consider rotating passwords and isolating the device.

Exploitation status

Google's release notes say it is aware that an exploit for CVE-2026-125350 exists in the wild.
CISA added it to KEV on 10 November 2026 with a due date of 24 November (KEV version 2026.11.10). Ransomware use is recorded as Unknown and forensic triage as No.
The CVE record carries CISA's assessment (exploitation active, not automatable, total technical impact).
No public information on scale, methods or attackers could be confirmed. How many in-the-wild Chrome flaws this makes this year is not stated in Google's notes and was not verified by this site, so it is not claimed here.

This site's view: confirm that it is relaunched, not just updated

A browser keeps running the old process after an update downloads until it is relaunched. On managed devices, update delivery and the user's restart are tracked separately. Measuring on "is the running version 157.0.8103.50 or later" reduces misses (Prioritising with CVSS, EPSS and KEV).

Sources

Google — Stable Channel Update for Desktop (Chrome Releases, 9 November 2026; fixed versions and the in-the-wild statement)
CVE.org — CVE-2026-125350 (published 10 November 2026; includes CISA's addition)
NVD — CVE-2026-125350
CISA KEV — Known Exploited Vulnerabilities Catalog (added 10 November, due 24 November)
Microsoft — Microsoft Edge Security Release Notes (used to check for an Edge fix)

Last verified: 11 November 2026.

FAQ

QWhat is CVE-2026-125350?

A use-after-free (CWE-416) in the XML component of Google Chrome. The CVE record says that in Chrome before 157.0.8103.50 a remote attacker could execute arbitrary code inside the sandbox through a crafted HTML page. Chromium rates it High; the CVSS v3.1 score of 8.8 was added by CISA.

QWhich version should I be on?

Google's Stable channel update is 157.0.8103.50 or .51 for Windows and Mac and 157.0.8103.50 for Linux. Check the version under About Chrome, then relaunch to apply it. Google says the rollout takes days to weeks, so if the update has not reached you, check for it manually.

QIs it being exploited?

Yes. Google's release notes say it is aware that an exploit for CVE-2026-125350 exists in the wild. CISA added it to KEV on 10 November (due 24 November). Scale, methods and attackers could not be confirmed from public information.

QAre Edge, Opera and other browsers affected?

CISA's KEV description says it could affect multiple Chromium-based browsers, including Chrome, Microsoft Edge and Opera. Each vendor ships its own fixed version. As far as this site could confirm from official sources, Microsoft's Edge security release notes did not yet list a version that includes this CVE. The notes do carry a 9 November announcement that Microsoft is aware of exploits in the wild and is working on a security fix (no CVE is named). Check each browser for updates and install the latest.

QIs this the same as the other XML flaw fixed in the same update (CVE-2026-125346)?

No, it is a separate CVE. The same update fixes CVE-2026-125346 (also a High use-after-free in XML), but Google mentioned an in-the-wild exploit only for CVE-2026-125350. Updating fixes both.

QWhat should administrators do?

Bring managed Chrome to 157.0.8103.50 (Windows and Mac also .51) or later and complete the relaunch. Check for policies that block updates or pin a version, and use the admin console's version list to find devices that have not updated. Chrome has relaunch-notification policies (such as RelaunchNotification) that you can use to prompt a restart. The KEV due date is 24 November.