Exploited in the wildHIGHCISA KEV

Chrome XML use-after-free CVE-2026-125350 exploited in the wild; fixed in 157.0.8103.50

Google patched a use-after-free in Chrome's XML component on 2026-11-09 and says an exploit exists in the wild. Update Chrome to 157.0.8103.50 or later, and patch Edge, Opera and other Chromium-based browsers as their vendors ship fixes.

Google Chrome / Chromium (XML component)CVE-2026-125350CVSS8.8CWE-416Endpoint & OS
Published Nov 12, 2026

Google says an exploit exists in the wild 1, and CISA added the CVE to KEV on 2026-11-10 3. Attackers, targets, delivery method and first-seen date have not been disclosed 9.

Oct 12, 202643 daysNov 24, 2026

What you need to know

  • Exposure: Chrome desktop before 157.0.8103.50 on Windows, macOS and Linux. Other Chromium-based browsers, including Edge and Opera, may also be affected.
  • Impact: a crafted web page can trigger a use-after-free in the XML component and run code inside the renderer sandbox. The victim only has to visit the page.
  • Google says an exploit exists in the wild, and news outlets call it a zero-day. CISA KEV lists it with a federal due date of 2026-11-24. No actor, target set or IOCs are public.
  • Fix: update to Chrome 157.0.8103.50/.51 and relaunch the browser. Apply each Chromium-based vendor's update and distro package fixes as they ship.
  • Detect: inventory browser versions across the fleet. Hunt for Chrome renderer processes that spawn child processes or write executables.

What's happening

CVE-2026-125350 is a use-after-free in the XML component of Google Chrome, fixed in Stable 157.0.8103.50/.51 on 2026-11-09 1. Google says it is aware that an exploit for the flaw exists in the wild 1. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-11-10, "based on evidence of active exploitation" 3. Federal agencies must remediate by 2026-11-24 2. The CVE record rates it CVSS 8.8, and Chromium rates it High severity 4.

Affected systems are Chrome desktop builds before 157.0.8103.50 on Windows, macOS and Linux 1. CISA notes that other Chromium-based browsers, such as Microsoft Edge and Opera, may also be affected 2. Distribution packages are being patched as well. Chainguard, BellSoft Alpaquita and FreeBSD have published fixed builds 5,6,7.

Google has not disclosed who is exploiting the bug, who is targeted, or how the exploit is delivered 9. KEV lists known ransomware use as Unknown 2. BleepingComputer, SecurityWeek and The Hacker News count it as the eighth exploited Chrome zero-day of 2026 8,9,10. None of these reports adds telemetry beyond Google's statement 8,9,10.

How it works

The bug is a use-after-free (CWE-416) in Chrome's XML handling 4. Google's release note labels it 'Use after free in XML' and references two Chromium issues, 572578603 and 582442907. Details stay restricted until most users have updated 1. No vendor root-cause analysis is public.

Exploitation needs no authentication. An attacker only has to get the victim to load a crafted HTML page 4,2. Successful exploitation gives arbitrary code execution inside the browser sandbox 4,2. Reaching the underlying system would need a separate sandbox escape, and no source reports one being chained with this bug. Any lure that gets a victim to load a page could deliver it, such as a phishing link, malvertising or a compromised site.

The underlying XML library is unconfirmed. Chainguard lists fixed packages for both chromium and libxslt under this CVE 5, and BellSoft ships a libxslt fix for Alpaquita 6. Google's note names only the XML component 1, so treat a libxslt link as unconfirmed. FreeBSD's entry also lists CVE-2026-125346, a separate use-after-free in XML 7. Only CVE-2026-125350 is flagged as exploited 1.

What to do

In order of priority
  1. 1

    Update Google Chrome to 157.0.8103.50/.51 on Windows and macOS, or 157.0.8103.50 on Linux 1. Google's rollout takes days to weeks, so push the update through enterprise management instead of waiting for auto-update 1.

  2. 2

    Enforce a browser relaunch after updating. The fix only takes effect after restart (More > Help > About Google Chrome, then Relaunch) 10.

  3. 3

    Patch Microsoft Edge, Opera, Brave and Vivaldi as each vendor ships the Chromium fix 10. CISA advises discontinuing use of a product where no mitigation is available 2.

  4. 4

    Update distribution packages: Chainguard chromium 157.0.8103.50-r1 and libxslt 1.1.45-r6 5, Alpaquita libxslt 1.1.43-r2 6, and FreeBSD chromium packages 157.0.8103.50 7.

  5. 5

    Until patched, reduce exposure. Block unpatched browser versions from sensitive applications through conditional access or browser management, and tighten web filtering for uncategorized and newly registered domains.

  6. 6

    Federal agencies must remediate by 2026-11-24 under BOD 26-04 2. The KEV entry does not require forensic triage 2.

  7. 7

    Google reported in-the-wild exploitation when it shipped the fix 1, so assume-breach checks are prudent on high-value endpoints. Review hosts that ran pre-fix Chrome for anomalous browser child processes or persistence.

Detection

  • No IOCs, exploit indicators or detection rules have been published for this CVE. Google has not described the attacks 9. Prioritize exposure checks and generic post-exploitation hunts.
  • Inventory browser versions using EDR software inventory, Chrome Browser Cloud Management or your MDM. Flag any Chrome below 157.0.8103.50 1. Flag FreeBSD chromium, ungoogled-chromium and linux-chrome packages below the same version 7.
  • Find endpoints where Chrome updated but did not relaunch. Compare the installed binary version with the running process version. Users can check under More > Help > About Google Chrome 10.
  • Track Edge, Opera, Brave and Vivaldi separately. Their fixed builds are not yet confirmed, so treat any build on a pre-fix Chromium base as exposed 2,10.
  • In container images and Linux hosts, scan for Chainguard chromium below 157.0.8103.50-r1 and libxslt below 1.1.45-r6 5. Also scan for Alpaquita libxslt below 1.1.43-r2 6.
  • In EDR telemetry, hunt for browser renderer processes (--type=renderer) that spawn shells, script interpreters or LOLBins. Also hunt for renderers writing executables or making unusual outbound connections. These patterns can indicate a follow-on sandbox escape.

Timeline

  1. Arni Hardarson (Neonix Security) reports the issue to Google under Chromium bug 572578603, per Google's release note. 1

  2. An anonymous researcher reports the issue under Chromium bug 582442907. 1

  3. Chrome Stable 157.0.8103.50/.51 ships the fix. Google states an exploit exists in the wild. 1

  4. CVE-2026-125350 record is published by the Chrome CNA. 4

  5. CISA adds CVE-2026-125350 to the KEV catalog. 3

  6. Chainguard publishes fixes for its chromium and libxslt packages. 5

  7. CISA KEV remediation due date for federal agencies. 2

Sources

  1. 1
    Chrome Releases: Stable Channel Update for Desktop
    Google Chrome Releases · Vendor · Nov 9, 2026
  2. 2
    Known Exploited Vulnerabilities Catalog: CVE-2026-125350
    CISA · Government · Nov 10, 2026
  3. 3
    CISA Adds Six Known Exploited Vulnerabilities to Catalog
    CISA · Government · Nov 10, 2026
  4. 4
    CVE Record: CVE-2026-125350
    CVE Program / Chrome CNA · Database · Nov 10, 2026
  5. 5
    Chainguard advisory CGA-xw74-54x3-56jp (CVE-2026-125350)
    Chainguard · Vendor · Nov 10, 2026
  6. 6
    CVE-2026-125350 (Alpaquita Linux)
    BellSoft · Vendor · Nov 11, 2026
  7. 7
    chromium -- security fixes
    FreeBSD VuXML · Database · Nov 10, 2026
  8. 8
    Google patches eighth Chrome zero-day exploited in attacks this year
    BleepingComputer · News · Nov 10, 2026
  9. 9
    Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
    SecurityWeek · News · Nov 10, 2026
  10. 10
    Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
    The Hacker News · News · Nov 10, 2026

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 10 sources, then checked against them by a separate review step on Nov 12, 2026.

Exploitation evidence is Google's in-the-wild statement and CISA's KEV listing. News coverage repeats Google. No attacker, target, delivery method or first-seen date has been disclosed.

No vendor, government or news source has confirmed a public proof-of-concept exploit.

Fixed versions for Edge, Opera, Brave and Vivaldi were not confirmed at publication. It is also unconfirmed whether Chrome Extended Stable includes the fix.

Some Linux distributions link this CVE to libxslt package fixes, but Google has not said which XML library is involved. CVE-2026-125346 is a separate XML bug and is not flagged as exploited.

KEV lists ransomware use as Unknown. The 'eighth exploited Chrome zero-day of 2026' count comes from news outlets, not Google.

Google credits two separate reports (2026-10-12 and 2026-11-06) under this CVE. It has not said which report covers the exploited bug.

Spotted an error? Open an issue on sochub.io.