Chrome Zero-Day CVE-2026-125350 Exploited in XML Parser

Google fixed Chrome zero-day CVE-2026-125350 on November 9, 2026, a high-severity use-after-free in the browser's XML component that attackers are already exploiting. Google says an exploit exists in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10 with a November 24 deadline. Update Chrome to 157.0.8103.50 or later on Linux and 157.0.8103.50/.51 on Windows and Mac, then make sure every user actually relaunches the browser.

What happened

Google published a Stable channel desktop update on Monday, November 9, that fixes nine security bugs. One of them, CVE-2026-125350, was already being used in attacks. Google's advisory says: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."

An anonymous researcher reported the bug to Google on November 6, according to SecurityWeek. That is three days from report to shipped fix, which is fast even by Chrome standards and usually means Google treated the exploitation evidence as credible.

Google has not said who is exploiting the flaw, who the targets are or how the attack chain works. The Chromium bug tracker entry (issue 582442907) is restricted, which is normal for Chrome zero-days. Google's standard language applies: bug details "may be kept restricted until a majority of users are updated with a fix."

This is the eighth exploited Chrome zero-day of 2026. The earlier seven are CVE-2026-2441 (CSS font features, February), CVE-2026-3909 (Skia) and CVE-2026-3910 (V8) in March, CVE-2026-5281 (Dawn/WebGPU, April), CVE-2026-11645 (V8, June) and the September V8 pair, CVE-2026-87491 and CVE-2026-85046. We covered the last of those in the September Chrome V8 zero-day report.

Who is affected by the Chrome zero-day

Every Chrome desktop install older than 157.0.8103.50 is vulnerable, according to the official CVE record. The fixed builds are:

Windows and macOS: 157.0.8103.50 or 157.0.8103.51
Linux: 157.0.8103.50

CISA's KEV entry is broader than Chrome. It states that the flaw "could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." Each of those vendors ships its own build on its own schedule, so a patched Chrome does not mean a patched Edge. At the time of writing we could not find a Microsoft Edge release that names CVE-2026-125350. Check the Edge security release notes and your other Chromium-based browsers directly before you mark this closed.

Federal civilian agencies must remediate by November 24, 2026 under CISA's BOD 26-04. Everyone else should treat that date as a ceiling, not a target.

Technical analysis

The CVE record describes the bug as a use-after-free in XML that "allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page." It maps to CWE-416. The CISA-ADP score is CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The UI:R part means the victim has to load attacker-controlled content, which in practice means visiting a page or rendering a link or ad.

A use-after-free happens when code frees a block of memory but keeps a pointer to it and uses that pointer later. If an attacker can control what gets allocated in the freed space, the stale pointer reads or writes attacker data. Our explainer on what a use-after-free vulnerability is walks through why this bug class keeps showing up in browsers.

The phrase "inside the sandbox" matters. Code execution in Chrome's renderer process is limited by the browser sandbox. Taking over the endpoint usually takes a second bug that escapes the sandbox. Google has not said whether attackers paired CVE-2026-125350 with an escape, and none was disclosed in this release. Assume a capable attacker has one: exploited Chrome bugs are frequently part of a chain.

The same release fixes six other high-severity bugs in WebGL, FileSystem, Compositing, GPU, V8 and XML, plus two medium-severity uninitialized resource issues in the GPU component. Google found most of them internally. Some early reports named CVE-2026-125346 as a second XML use-after-free; the CVE record for that ID now shows it as REJECTED, so do not track it as a separate issue.

What to do now

Push Chrome 157.0.8103.50 or later to every managed endpoint today. Chrome downloads updates in the background but only applies them on relaunch, so a user who never closes the browser stays exposed. If your fleet does not force relaunches yet, follow our guide on how to enforce browser updates across a managed fleet.
Verify versions from your inventory or endpoint management tool, not from the update console. On a single machine, Google's help page says to open More, then Help, then About Google Chrome; the version appears under the heading and Chrome checks for updates on that page.
Inventory every other Chromium-based browser and embedded runtime (Edge, Opera, Brave, Electron apps) and track each vendor's fix separately.
Linux users update through the package manager; Chromebooks update through the operating system, per Google.
Review EDR telemetry for unusual child processes or file writes from browser processes on high-value users' machines since early November. There are no published indicators, so hunt on behavior.

With no technical details or indicators available, the response is mostly about speed and coverage. Our guide to browser zero-day response when the vendor shares nothing lays out a short playbook for this exact situation.

What to watch next

A Microsoft Edge security release that lists CVE-2026-125350, and matching releases from Opera, Brave and Vivaldi.
Google lifting the restriction on issue 582442907 once most users are updated. That is when exploitation details, and copycat interest, usually appear. Our piece on why vendors withhold zero-day details explains the trade-off.
Any attribution from Google's Threat Analysis Group or a third-party researcher. Many of 2025's Chrome zero-days were reported by TAG, which tracks commercial spyware.
A KEV update marking known ransomware use, which is currently listed as unknown.