CVE-2026-125350
Remote code execution in Google Chrome via XML use-after-free flaw.
A use-after-free vulnerability in Chrome's XML handling allows a remote attacker to execute arbitrary code inside the browser's sandbox by luring a user to a crafted HTML page. All users of Chrome prior to version 157.0.8103.50 are affected. The flaw is being actively exploited, and CISA has added it to its known-exploited list, requiring US federal agencies to fix it by November 24, 2026.
Google Chrome · Updated 11 Nov · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 10 Nov; US agencies must fix by 24 Nov
SeverityhighCVSS 8.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| Chrome 157.0 | 157.0.8103.50 |
What to do
- Update Google Chrome to version 157.0.8103.50 or later, which contains the official fix.
- Enable automatic updates in Chrome to receive patches promptly.
- Advise users not to click on suspicious links or open untrusted HTML pages until the update is applied.
What happened
- 10 NovCISA added CVE-2026-125350 to its known-exploited vulnerabilities catalog.
- 10 NovMultiple news outlets reported that Google patched an eighth Chrome zero-day exploited in attacks this year.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-125350 | Google Chromium Use-After-Free Vulnerability | high 8.8 | 10 Nov | 1.0% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
Krebs on Security · 10 NovMicrosoft Fixes Nearly 1,100 Security Vulnerabilities ↗www.theregister.com - Articles · 10 NovChrome zero-day whack-a-mole continues as 2026 tally hits 8 ↗CISA · 10 NovCISA Adds Six Known Exploited Vulnerabilities to Catalog ↗BleepingComputer · 10 NovGoogle patches eighth Chrome zero-day exploited in attacks this year ↗The Hacker News · 10 NovGoogle Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 ↗The records
CISA known-exploited catalog ↗CVE-2026-125350 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free