---
schema: 1
kind: vulnerability
title: "CVE-2026-125350, Google Chrome before 157.0.8103.50: a use-after-free in the XML component is exploited in the wild and listed by CISA; Edge for Android carries the fix, Edge desktop and other Chromium browsers are still to follow"
headline: "Chrome zero-day CVE-2026-125350 exploited: update Chrome and relaunch; Edge for Android fixed, Edge desktop pending"
summary: >
  Google's Stable-channel update of 2026-11-09 says an exploit for CVE-2026-125350, a high-severity use-after-free in Chromium's XML component, exists in the wild; CISA added it to its Known Exploited Vulnerabilities catalog on 2026-11-10 and no source describes the attacks. The fix is in Stable 157.0.8103.50 (Linux) and 157.0.8103.50 or .51 (Windows, macOS) and in Extended Stable 156.0.8078.96, all of 2026-11-09, later Stable and Extended Stable builds of 2026-11-11 include it, and Microsoft's notes list the fix in Edge for Android 157.0.4341.53 while no Edge desktop release names it yet.
discovered_at: "2026-11-11T03:36:30Z"
updated_at: "2026-11-12T04:16:00Z"
event_date: "2026-11-09"
run_id: 2026-11-11T0256Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, zero-day, rce, actively-exploited, cisa-kev, patch-available]
regions: [global]
sectors: []
entities: []
techniques: [T1189, T1203]
affected_products: ["Google Chrome", "Microsoft Edge"]
cves:
  - id: CVE-2026-125350
    cvss: null
    epss: null
    type: memory-corruption
    vector: user-interaction
    auth: pre-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "Google Chrome before 157.0.8103.50 (Linux) and before 157.0.8103.50/.51 (Windows, macOS); Chrome Extended Stable before 156.0.8078.96; Microsoft Edge for Android before 157.0.4341.53; other Chromium-based browsers, Edge desktop included, until their vendors ship the fix"
    fixed: "157.0.8103.50 (Linux); 157.0.8103.50/.51 (Windows, macOS), included in the later 157.0.8103.78/.79; Extended Stable 156.0.8078.96, included in 156.0.8078.100; Edge for Android 157.0.4341.53"
sources:
  - url: "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
    publisher: "Google (Chrome Releases)"
    date: "2026-11-09"
    role: primary
  - url: "https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog"
    publisher: "CISA"
    date: "2026-11-10"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA Known Exploited Vulnerabilities catalog"
    date: "2026-11-10"
    role: corroborating
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13165"
    publisher: "NCSC Switzerland (Cyber Security Hub)"
    date: "2026-11-10"
    role: corroborating
  - url: "https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/"
    publisher: "SecurityWeek"
    date: "2026-11-10"
    role: corroborating
  - url: "https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_0910980127.html"
    publisher: "Google (Chrome Releases)"
    date: "2026-11-09"
    role: corroborating
  - url: "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"
    publisher: "Google (Chrome Releases)"
    date: "2026-11-11"
    role: corroborating
  - url: "https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_01570615041.html"
    publisher: "Google (Chrome Releases, Extended Stable)"
    date: "2026-11-11"
    role: corroborating
  - url: "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security"
    publisher: "Microsoft Edge security release notes"
    date: "2026-11-11"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."
    publisher: "Google (Chrome Releases)"
    source_url: "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
  - quote: "High CVE-2026-125350: Use after free in XML. Reported by Arni Hardarson (Neonix Security) on 2026-10-12 and anonymous on 2026-11-06"
    publisher: "Google (Chrome Releases)"
    source_url: "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html"
  - quote: "Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage."
    publisher: "CISA Known Exploited Vulnerabilities catalog"
    source_url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
  - quote: "no information appears to be available on the attacks exploiting CVE-2026-125350"
    publisher: "SecurityWeek"
    source_url: "https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/"
  - quote: "has an exploit in the wild, and this update contains a fix for it."
    publisher: "Microsoft Edge security release notes"
    source_url: "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security"
verification: multi-source
sourcing_note: >
  Google's release notes state the in-the-wild exploit and carry the fix; CISA's catalog listing is a separate assessment and gives the sandbox statement. No source describes the attacks, the actor or the victims, and no CVSS score appears on the cited pages. Google's 2026-11-11 posts for Stable and Extended Stable do not mention the CVE; that they include the fix follows from their later version numbers and change-log ranges, which Google does not state. Microsoft's Security Update Guide returned no record for the CVE when queried, while Microsoft's Edge release notes list the fix for Edge for Android only.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Update Chrome to the current Stable build, 157.0.8103.78 or later (157.0.8103.50 is the first fixed build), and Extended Stable to 156.0.8078.100 or later on every managed endpoint, force the browser relaunch now, update Edge for Android to 157.0.4341.53, and install the Edge desktop and other Chromium-browser updates as soon as each vendor lists CVE-2026-125350 as fixed."
updates:
  - at: "2026-11-12T04:16:00Z"
    run_id: 2026-11-12T0255Z-intel
    type: update
    summary: >
      Microsoft's Edge notes now list the exploited-flaw fix in Edge for Android 157.0.4341.53 while no Edge desktop release names it, Extended Stable 156.0.8078.96 of 2026-11-09 already carried the fix, and Stable 157.0.8103.78/.79 and Extended Stable 156.0.8078.100 of 2026-11-11 replace the first fixed builds as the update target; Google's Stable page files a second XML bug under the exploited CVE while its Extended Stable page lists it under its own id.
    fields: [title, headline, summary, cves, sources, evidence, sourcing_note, actions, body]
migrated_from: null
---

Google's Stable-channel update of 2026-11-09 moves Chrome to 157.0.8103.50 on Linux and 157.0.8103.50/.51 on Windows and macOS and states "Google is aware that an exploit for CVE-2026-125350 exists in the wild" ([Google, 2026-11-09](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)). CVE-2026-125350 is a high-severity use-after-free in the XML component, reported by Arni Hardarson (Neonix Security) on 2026-10-12 and by an anonymous reporter on 2026-11-06 ([Google, 2026-11-09](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)). The Extended Stable update of the same day, 156.0.8078.96, lists the CVE as well ([Google, 2026-11-09](https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_0910980127.html)). CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on 2026-11-10 ([CISA, 2026-11-10](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog)) and describes it as a flaw that could let a remote attacker execute arbitrary code inside the sandbox through a specially crafted webpage ([CISA, 2026-11-10](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). No source describes the attacks: SecurityWeek, which counts it as the eighth Chrome zero-day of the year, writes that no information appears to be available on them ([SecurityWeek, 2026-11-10](https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/)). NCSC Switzerland rates the flaw as actively exploited ([NCSC Switzerland, 2026-11-10](https://security-hub.ncsc.admin.ch/#/posts/13165)). Microsoft's Edge release notes state that Edge for Android 157.0.4341.53 contains the fix, list no Edge desktop release that names the CVE and still say Microsoft is working on a security fix ([Microsoft, 2026-11-11](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)).

**Exposure:** Chrome desktop below 157.0.8103.50, Chrome Extended Stable below 156.0.8078.96, Edge for Android below 157.0.4341.53, and any other Chromium-based browser (Edge desktop, Brave, Opera, Vivaldi) until its vendor ships the fix; the build shows in chrome://version or in the managed-browser inventory, and Google rolls the release out over days to weeks, so a pending relaunch leaves a patched machine still running the old code ([Google, 2026-11-09](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)).

**Detection:** neither Google nor CISA publishes an indicator, so the controls are the browser-version inventory and the browser's own crash and child-process telemetry: a renderer crash followed, for the same user, by a browser-spawned shell or script interpreter, a new scheduled task or a connection to a newly registered domain is the sequence to weigh up.

**Triage:** renderer crashes are common and benign; the discriminator is what follows them on the same host.

**Defender takeaway:** treat the update as out-of-band: force Chrome to the current Stable build (157.0.8103.50 is the first fixed one) and the relaunch on every managed endpoint now, move Extended Stable and Edge for Android to their fixed builds, and push the Edge desktop and other Chromium fixes the day each vendor lists CVE-2026-125350, because the exploit is in use and the sources give no way to tell who is targeted.

## Update — 2026-11-12T04:16:00Z

Google released Stable 157.0.8103.78/.79 on 2026-11-11 with 83 security fixes, five of them Critical use-after-free bugs ([Google, 2026-11-11](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html)), and Extended Stable 156.0.8078.100 the same day with 72 fixes, four of them Critical ([Google, 2026-11-11](https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_01570615041.html)); neither post lists the XML use-after-free again, and both builds are later than the fixed ones. Microsoft's Edge release notes of the same day list Edge for Android 157.0.4341.53 as containing the fix, while the newest Edge desktop release on the page is 157.0.4341.42 of 2026-11-05 and names no CVE ([Microsoft, 2026-11-11](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)). Google's Stable page for 157.0.8103.50 files Chromium bug 572578603 inside the row for the exploited flaw ([Google, 2026-11-09](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)). Its Extended Stable page of the same day lists the same bug as a separate High row under its own CVE id ([Google, 2026-11-09](https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_0910980127.html)); both pages list it as fixed and differ only on its CVE id.