CISA lists exploited Chromium zero-day CVE-2026-125350 in KEV
Original title: CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks
A crafted page can run code in the sandbox; Chrome 157.0.8103.50 and Extended Stable 156.0.8078.96 contain the fix.
CISA added CVE-2026-125350, a use-after-free in Chromium’s XML component, to the KEV catalog on November 10, 2026, and says attackers are already using it. Opening a crafted page can let a remote attacker run arbitrary code inside the browser sandbox. Google patched Chrome on November 9: 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. Edge, Opera, Brave and Vivaldi may share the weakness, but their fix dates are not confirmed.
Unconfirmed: Google says an exploit exists in the wild but has not identified the attackers, victims or method.
- An anonymous researcher reported the flaw on November 6.
- The Chrome release included nine security fixes.
- SecurityWeek counts this as the eighth exploited Chrome zero-day this year.
- CISA lists ransomware use of the flaw as unknown.
- Nothing public shows a second bug was used to escape the sandbox.
Impact: Arbitrary code execution inside the browser sandbox
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | — | 157.0.8103.50/.51 for Windows and Mac; 157.0.8103.50 for Linux; Extended Stable 156.0.8078.96 |
| Microsoft Edge | — | — |
| Opera | — | — |
| Brave | — | — |
| Vivaldi | — | — |
- 1.Update Chrome to 157.0.8103.50 or higher and restart the browser.
- 2.Install Edge, Brave, Opera and Vivaldi updates as soon as vendors publish them.
- 3.Push the update to managed devices and confirm browsers were restarted.
- CVEs
- CVE-2026-125350
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | <1% | KEVPoC ×3 | KEV |
From the original article
3 min read at cybersecuritynews.com
CISA has added a new Google Chromium zero-day CVE-2026-125350 to its Known Exploited Vulnerabilities (KEV) catalog and says attackers are already using it. It sits in the browser’s XML component and could let a remote attacker run code through a specially crafted webpage. Anyone who uses Chrome, Edge, or Opera should check their browser version […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.