HighCVSS8.82026-11-11
CVE-2026-125350 — Google Chrome XML use-after-free exploited in the wild: explainer and fix (fixed in 157.0.8103.50, listed in KEV)
A use-after-free in Google Chrome's XML component (CWE-416, Chromium severity High) that can allow code execution inside the sandbox through a crafted web page. Google says it is aware that an exploit for this CVE exists in the wild. Fixed in Chrome 157.0.8103.50 (Windows and Mac also .51). Added to CISA KEV on 10 November (due 24 November); KEV says it may affect other Chromium-based browsers such as Edge and Opera. This site's view: update Chrome and restart it, and check each other Chromium-based browser for its own update.