CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge for Android carries the fix, Edge desktop and other Chromium browsers are still to follow
Chrome zero-day CVE-2026-125350 exploited: update Chrome and relaunch; Edge for Android fixed, Edge desktop pending
Defender actions
- Update Chrome to the current Stable build, 157.0.8103.78 or later (157.0.8103.50 is the first fixed build), and Extended Stable to 156.0.8078.100 or later on every managed endpoint, force the browser relaunch now, update Edge for Android to 157.0.4341.53, and install the Edge desktop and other Chromium-browser updates as soon as each vendor lists CVE-2026-125350 as fixed.
Analysis
Google's Stable-channel update of 2026-11-09 moves Chrome to 157.0.8103.50 on Linux and 157.0.8103.50/.51 on Windows and macOS and states "Google is aware that an exploit for CVE-2026-125350 exists in the wild" (Google, 2026-11-09). CVE-2026-125350 is a high-severity use-after-free in the XML component, reported by Arni Hardarson (Neonix Security) on 2026-10-12 and by an anonymous reporter on 2026-11-06 (Google, 2026-11-09). The Extended Stable update of the same day, 156.0.8078.96, lists the CVE as well (Google, 2026-11-09). CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA, 2026-11-10) and describes it as a flaw that could let a remote attacker execute arbitrary code inside the sandbox through a specially crafted webpage (CISA, 2026-11-10). No source describes the attacks: SecurityWeek, which counts it as the eighth Chrome zero-day of the year, writes that no information appears to be available on them (SecurityWeek, 2026-11-10). NCSC Switzerland rates the flaw as actively exploited (NCSC Switzerland, 2026-11-10). Microsoft's Edge release notes state that Edge for Android 157.0.4341.53 contains the fix, list no Edge desktop release that names the CVE and still say Microsoft is working on a security fix (Microsoft, 2026-11-11).
Triage: renderer crashes are common and benign; the discriminator is what follows them on the same host.
Cited evidence
Google is aware that an exploit for CVE-2026-125350 exists in the wild.
High CVE-2026-125350: Use after free in XML. Reported by Arni Hardarson (Neonix Security) on 2026-10-12 and anonymous on 2026-11-06
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage.
no information appears to be available on the attacks exploiting CVE-2026-125350
has an exploit in the wild, and this update contains a fix for it.
Updates1
Google released Stable 157.0.8103.78/.79 on 2026-11-11 with 83 security fixes, five of them Critical use-after-free bugs (Google, 2026-11-11), and Extended Stable 156.0.8078.100 the same day with 72 fixes, four of them Critical (Google, 2026-11-11); neither post lists the XML use-after-free again, and both builds are later than the fixed ones. Microsoft's Edge release notes of the same day list Edge for Android 157.0.4341.53 as containing the fix, while the newest Edge desktop release on the page is 157.0.4341.42 of 2026-11-05 and names no CVE (Microsoft, 2026-11-11). Google's Stable page for 157.0.8103.50 files Chromium bug 572578603 inside the row for the exploited flaw (Google, 2026-11-09). Its Extended Stable page of the same day lists the same bug as a separate High row under its own CVE id (Google, 2026-11-09); both pages list it as fixed and differ only on its CVE id.
Sources9
Revision history
- Published 2026-11-11T0256Z-intel
- Update 2026-11-12T0255Z-intel
Microsoft's Edge notes now list the exploited-flaw fix in Edge for Android 157.0.4341.53 while no Edge desktop release names it, Extended Stable 156.0.8078.96 of 2026-11-09 already carried the fix, and Stable 157.0.8103.78/.79 and Extended Stable 156.0.8078.100 of 2026-11-11 replace the first fixed builds as the update target; Google's Stable page files a second XML bug under the exploited CVE while its Extended Stable page lists it under its own id.
Changed: title headline summary cves sources evidence sourcing_note actions body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.