CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge and other Chromium browsers are still to follow

cve · CVE-2026-125350

Coverage
1
first 2026-11-11 → last 2026-11-12
Latest activity
2026-11-12
Chrome zero-day CVE-2026-125350 exploited: update Chrome and relaunch; Edge for Android fixed, Edge desktop…
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
9
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-125350, newest first. Check the date before acting on an older one.

  • Update Chrome to the current Stable build, 157.0.8103.78 or later (157.0.8103.50 is the first fixed build), and Extended Stable to 156.0.8078.100 or later on every managed endpoint, force the browser relaunch now, update Edge for Android to 157.0.4341.53, and install the Edge desktop and other Chromium-browser updates as soon as each vendor lists CVE-2026-125350 as fixed.
    2026-11-11CVE-2026-125350

Defender insights

What each entry about CVE-2026-125350 tells a defender to do, newest first.

2026-11-11HIGHexploitedChrome zero-day CVE-2026-125350 exploited: update Chrome and relaunch; Edge for Android fixed, Edge desktop pending

Exposure · triage · detection

Story timeline

  1. 2026-11-11CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge for Android carries the fix, Edge desktop and other Chromium browsers are still to follow
    trending-vulnerabilitiesChrome zero-day CVE-2026-125350 exploited: update Chrome and relaunch; Edge for Android fixed, Edge desktop pending

Hunting pivots

Affected products
Google ChromeMicrosoft Edge
Tags
actively-exploitedcisa-kevpatch-availablercevulnerabilitieszero-day
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessDrive-by Compromise
  • ExecutionExploitation for Client Execution

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-11-11/cve-2026-125350-chrome-xml-use-after-free-exploited-kev · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-11-11/cve-2026-125350-chrome-xml-use-after-free-exploited-kev · ATT&CK page ↗

Entries about CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge and other Chromium browsers are still to follow (1)

2026-11-11 · view entry permalink →

HIGHCVE-2026-125350exploitedupdatedNATOA1

CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge for Android carries the fix, Edge desktop and other Chromium browsers are still to follow

Google's Stable-channel update of 2026-11-09 moves Chrome to 157.0.8103.50 on Linux and 157.0.8103.50/.51 on Windows and macOS and states "Google is aware that an exploit for CVE-2026-125350 exists in the wild" (Google, 2026-11-09). CVE-2026-125350 is a high-severity use-after-free in the XML component, reported by Arni Hardarson (Neonix Security) on 2026-10-12 and by an anonymous reporter on 2026-11-06 (Google, 2026-11-09). The Extended Stable update of the same day, 156.0.8078.96, lists the CVE as well (Google, 2026-11-09). CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA, 2026-11-10) and describes it as a flaw that could let a remote attacker execute arbitrary code inside the sandbox through a specially crafted webpage (CISA, 2026-11-10). No source describes the attacks: SecurityWeek, which counts it as the eighth Chrome zero-day of the year, writes that no information appears to be available on them (SecurityWeek, 2026-11-10). NCSC Switzerland rates the flaw as actively exploited (NCSC Switzerland, 2026-11-10). Microsoft's Edge release notes state that Edge for Android 157.0.4341.53 contains the fix, list no Edge desktop release that names the CVE and still say Microsoft is working on a security fix (Microsoft, 2026-11-11).

Triage: renderer crashes are common and benign; the discriminator is what follows them on the same host.

Google is aware that an exploit for CVE-2026-125350 exists in the wild.

High CVE-2026-125350: Use after free in XML. Reported by Arni Hardarson (Neonix Security) on 2026-10-12 and anonymous on 2026-11-06

Google (Chrome Releases) 2026-11-09

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage.

CISA Known Exploited Vulnerabilities catalog 2026-11-10

no information appears to be available on the attacks exploiting CVE-2026-125350

SecurityWeek 2026-11-10

has an exploit in the wild, and this update contains a fix for it.

Microsoft Edge security release notes 2026-11-11
Updaterun 2026-11-12T0255Z-inteltitleheadlinesummarycvessourcesevidencesourcing_noteactionsbody

Google released Stable 157.0.8103.78/.79 on 2026-11-11 with 83 security fixes, five of them Critical use-after-free bugs (Google, 2026-11-11), and Extended Stable 156.0.8078.100 the same day with 72 fixes, four of them Critical (Google, 2026-11-11); neither post lists the XML use-after-free again, and both builds are later than the fixed ones. Microsoft's Edge release notes of the same day list Edge for Android 157.0.4341.53 as containing the fix, while the newest Edge desktop release on the page is 157.0.4341.42 of 2026-11-05 and names no CVE (Microsoft, 2026-11-11). Google's Stable page for 157.0.8103.50 files Chromium bug 572578603 inside the row for the exploited flaw (Google, 2026-11-09). Its Extended Stable page of the same day lists the same bug as a separate High row under its own CVE id (Google, 2026-11-09); both pages list it as fixed and differ only on its CVE id.

vulnerability11 Nov 03:36Zmulti-sourceOpen finding →
Sources: Google (Chrome Releases) · CISA · CISA Known Exploited Vulnerabilities catalog · NCSC Switzerland (Cyber Security Hub) · SecurityWeek · Google (Chrome Releases, Extended Stable) · Microsoft Edge security release notes

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • chromereleases.googleblog.com4 (44%)
  • cisa.gov2 (22%)
  • learn.microsoft.com1 (11%)
  • security-hub.ncsc.admin.ch1 (11%)
  • securityweek.com1 (11%)

External references

NVD · cve.org · CISA KEV

All cited sources (9)