Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA adds Chromium XML use-after-free CVE-2026-125350 to KEV

Original title: CISA KEV: Google Chromium Use-After-Free Vulnerability — Google Chromium (CVE-2026-125350)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 7 sourcesGoogle patches exploited Chrome XML use-after-free, eighth 2026 zero-dayMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A crafted webpage can run code inside the Chromium sandbox; federal mitigation deadline is November 24.

CISA added CVE-2026-125350, a use-after-free in Chromium’s XML component, to the Known Exploited Vulnerabilities catalog. A remote attacker can execute arbitrary code inside the sandbox through a specially crafted webpage. Chrome, Edge, Opera and other Chromium browsers may be affected. Stakeholders must apply vendor mitigations under BOD 26-04 by November 24, or stop using the product if none exist.

Unconfirmed: Whether ransomware campaigns use CVE-2026-125350 is listed as unknown.

Key facts
  • Due date for required action is November 24, 2026.
  • Known ransomware campaign use is listed as unknown.
  • CISA also points agencies to forensics triage requirements.
  • No affected or fixed version strings are stated.
Security assessment · AI, from the articleExploited in the wild

Impact: Arbitrary code execution inside the browser sandbox

ProductAffected
Google Chromium—
Google Chrome—
Microsoft Edge—
Opera—
What to do
  1. 1.Apply vendor mitigations and follow BOD 26-04 by November 24, 2026.
  2. 2.Discontinue use if mitigations are unavailable.
  3. 3.Evaluate each asset’s internet exposure against BOD 26-04.
Analyze CVE-2026-125350 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-125350
ATT&CK
T1189 Drive-by CompromiseT1203 Exploitation for Client Execution
Tags
chromiumchromeedgeuse-after-freekevcisa
Vendors
GoogleMicrosoftOpera
Products
ChromiumChromeEdge
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-125350
Use-after-free in Chrome XML before 157.0.8103.50
8.8—KEVPoC
KEV

From the original article

1 min read at cisa.gov

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.