INEAvailable
EWPT
CVE-2026-125350 Google Chromium Vulnerability: Patch Now
CVE-2026-125350 is a use-after-free bug in Chrome's XML component that CISA lists as exploited. Update Chrome to 157.0.8103.50 or later and check other Chromium browsers.
Short answer: CVE-2026-125350 is a use-after-free flaw in XML in Google Chrome before 157.0.8103.50. A crafted HTML page can run code inside the sandbox, and CISA added it to the KEV catalog on 2026-11-10. Update Chrome and any Chromium-based browser now, then verify the version on every machine.
What happened with CVE-2026-125350
Google fixed an exploited use-after-free bug in Chrome. Update to 157.0.8103.50 or later today. The NVD record describes it as a "Use after free in XML in Google Chrome prior to 157.0.8103.50" that lets a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page.
CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-11-10. Google's fix came in a Stable Channel Update for Desktop dated Monday, November 9, 2026.
Who is affected
Anyone running Chrome older than the fixed build. The flaw is in Chromium, so other browsers built on it may be affected too. That includes Microsoft Edge and Opera.
Product | Affected | Fixed |
|---|---|---|
Google Chrome (desktop) | Earlier than |
|
Microsoft Edge, Opera, other Chromium browsers | Check each vendor's advisory | The vendor's patched release |
Edge and Opera use their own version numbers. Do not compare them to the Chrome number. Apps that embed Chromium also often need their own update.
How serious it is and whether it is exploited
NVD scores it 8.8 HIGH with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: it works over the network, needs no privileges and is easy to attempt. The victim only has to open a malicious page. Chromium rates the severity High, and the weakness is CWE-416 (use after free).
The code runs "inside the sandbox." That limits the damage, but attackers commonly pair a bug like this with a second flaw to escape the sandbox. Treat it as a real intrusion path, not a minor bug.
It is exploited enough to be in CISA KEV. The federal due date is 2026-11-24. Ransomware use is listed as unknown, so check the CISA KEV entry for updates.
What to do now
Patching is the fix. The required action says to apply mitigations per vendor instructions and follow CISA's BOD 26-04 guidance. It also points to CISA's "Forensics Triage Requirements." If mitigations are unavailable, it says to discontinue use of the product.
Update Chrome to
157.0.8103.50or later on every desktop.Restart the browser. The patch does not apply until Chrome relaunches.
Update Edge, Opera and other Chromium browsers from each vendor's release notes.
Rank assets by internet exposure, as BOD 26-04 asks. Start with machines used for general browsing.
Federal agencies and their contractors: follow the forensic triage steps, not just the patch.
In a browser, open chrome://settings/help to trigger the update. Then open chrome://version to confirm the build.
Commands to check your exposure
Run these on a sample machine first. Each prints the installed version.
# Linux
google-chrome --version
dpkg -l google-chrome-stable
rpm -q google-chrome-stable
# Linux: upgrade only Chrome (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade google-chrome-stable
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version# Windows PowerShell: Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Windows PowerShell: Edge version
(Get-Item "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe").VersionInfo.ProductVersionPer-user installs can live under %LOCALAPPDATA%\Google\Chrome\Application. Adjust the path if the files above are missing. On managed fleets, set the RelaunchNotification and RelaunchNotificationPeriod Chrome policies. They push users to restart after an update.
Worked example: triaging a small fleet
Say you check four machines and get these Chrome versions. Compare each to 157.0.8103.50.
Machine | Version found | Status |
|---|---|---|
Laptop A |
| Vulnerable. Update and relaunch. |
Laptop B |
| Fixed. |
Kiosk C |
| Vulnerable. Update first, since it is internet-facing. |
Dev box D |
| Newer than the fixed build. |
Compare the numbers part by part, from left to right. A version with a lower third or fourth part is older. Record the result and the date, because auditors and incident responders will ask.
What IT and security learners can take from this
This bug shows why sandboxes, patch SLAs and asset inventories matter. A KEV entry with a two-week due date is a good model for how real risk-based patching works. If you want to practice triage like this, the CompTIA CySA+ (CS0-003) voucher covers vulnerability management and response. Our Cybersecurity certification page lists related exams. For another recent patch-now case, see our Cisco BroadWorks CVE write-up.
Sources
Questions about this topic
Is a Chrome update enough, or do I need to restart too?
You need both. Chrome downloads the update in the background, but the old code keeps running until you relaunch. Check `chrome://version` afterward to confirm the build is `157.0.8103.50` or later.
Does the sandbox make this bug harmless?
No. The code runs inside the sandbox, which limits what an attacker can reach. Attackers often chain a second flaw to break out. With a CVSS score of 8.8 and a KEV listing, patch promptly.
How do I know if my Edge or Opera browser is fixed?
Those browsers use their own version numbers. Read the vendor's release notes or security advisory for the build that includes the Chromium fix. Then compare it to the version your command or About page shows.
Do I have to follow BOD 26-04 if I am not a federal agency?
The directive binds U.S. federal agencies. Other organizations can still use it as a model. Rank assets by internet exposure, patch the most exposed first, and keep records of what you checked.
What triggers this bug?
An attacker needs the victim to load a crafted HTML page. The user interaction is the visit itself. That is why general-purpose browsing machines and shared kiosks deserve attention first.
