Google patches exploited Chrome zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 fix a use-after-free in Chrome's XML parser; attack details stay restricted.
88
CVE-2026-125350
Use-after-free in Chrome XML before 157.0.8103.50
CISA: Google Chromium Use-After-Free Vulnerability
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
A use-after-free in Google Chrome’s XML handling lets a remote attacker run arbitrary code inside the sandbox by getting a user to open a crafted HTML page. It affects Chrome before 157.0.8103.50. Reports say attackers are already exploiting it.
What to do: Update Google Chrome to 157.0.8103.50 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | prior to 157.0.8103.50 | 157.0.8103.50 |
Estimated exposure
largeNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
KEVCISA Known Exploited Vulnerability
- Affected
- Google Chromium
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
In the news
11 storiesGoogle fixes exploited Chrome XML use-after-free zero-day CVE-2026-125350
Stable builds 157.0.8103.50/.51 close the high-severity bug; Google is withholding details until most users update.
88
Google fixes exploited Chrome zero-day CVE-2026-125350
The use-after-free in XML is the eighth exploited Chrome zero-day of 2026; fixed builds are 157.0.8103.50 and .51.
86
CISA adds Chromium XML use-after-free CVE-2026-125350 to KEV
A crafted webpage can run code inside the Chromium sandbox; federal mitigation deadline is November 24.
86
Google patches exploited Chrome XML use-after-free, CVE-2026-125350
Stable updates reach 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux and Android.
84
Google patches exploited Chrome XML use-after-free CVE-2026-125350
Chrome 157.0.8103.50 and .51 fix the XML bug; Google says an exploit is already in the wild.
84
Google patches in-the-wild Chrome XML zero-day CVE-2026-125350
Stable builds 157.0.8103.50 and .51 close nine flaws; Google has not confirmed code execution or named attackers.
82
Google patches exploited Chrome zero-day CVE-2026-125350, its eighth of 2026
The high-severity XML use-after-free is fixed in Chrome 157.0.8103.50 and .51; exploit details remain withheld.
78
CISA adds six exploited vulnerabilities to its KEV catalog
Entries cover Cisco BroadWorks, Barracuda products, Outlook, and Chromium; FCEB agencies must prioritize them under BOD 26-04.
78
Chrome 157 patches exploited XML use-after-free, CVE-2026-125350
Windows and Mac builds 157.0.8103.50 and .51, and Linux 157.0.8103.50, include the fix.
78
Microsoft patches nearly 1,100 flaws, including exploited Outlook bug
CVE-2026-124194 is the only flaw Microsoft says is already exploited; 63 of this month's fixes are rated critical.
76