Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-125350 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | |
| Product | Chromium |
| Vulnerability Type | use-after-free (CWE-416) |
| CVSS Score | 8.8 (high) |
| EPSS Score | No data |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-11-24 |
Vulnerability Description
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. According to NVD, the fix is in Google Chrome 157.0.8103.50.
CISA has added the flaw to the KEV catalog, confirming active exploitation, and set a remediation deadline of November 24, 2026 for US federal agencies. Code execution inside the sandbox is usually the first link in a chain — attackers combine it with a second flaw to escape the sandbox.
Required Actions
- Update Google Chrome to 157.0.8103.50 or later and force a browser restart (the update only takes effect after relaunch).
- Update other Chromium-based browsers (Microsoft Edge, Opera, Brave) to the fixed version as soon as their vendors release it.
- Check browser versions on endpoints in your management console (Intune, GPO, Chrome Enterprise) — including servers and VDI machines.
Who Is Affected?
The vulnerability affects Chromium-based browsers — Google Chrome, Microsoft Edge, Opera and others — on all platforms. In practice it covers almost every workstation in an organization.
Sources
- NVD - CVE-2026-125350
- Chrome Releases - Stable Channel Update for Desktop
- CISA KEV Catalog
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-125350 vulnerability?
CVE-2026-125350 is a use-after-free flaw (CWE-416) in the Chromium XML component that allows code execution inside the browser sandbox. CVSS score: 8.8; the flaw is listed in the CISA KEV catalog.
Does exploiting CVE-2026-125350 require authentication?
No. It is enough for the user to open a crafted web page.
How to protect against CVE-2026-125350?
Update Chrome to 157.0.8103.50 or later, restart the browser and update other Chromium-based browsers. The CISA deadline is November 24, 2026.
Who is affected by CVE-2026-125350?
Users of Google Chrome, Microsoft Edge, Opera and other Chromium-based browsers.
