CISA has added CVE-2026-125350, a high-severity use-after-free bug in Google Chromium's XML component, to its Known Exploited Vulnerabilities (KEV) catalog, which confirms attackers are exploiting it in the wild.
What Is It
CVE-2026-125350 is a use-after-free vulnerability (CWE-416) in the XML component of Google Chromium. According to NVD, a remote attacker can use a crafted HTML page to run arbitrary code inside the browser sandbox in Google Chrome versions before 157.0.8103.50. Google rates it as "High" severity in Chromium's own scale.
NVD lists a CVSS v3.1 base score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack works over the network, is low in complexity, and needs no privileges. It does need the user to do something, such as visit a malicious webpage.
Why It Matters
CISA KEV confirms active exploitation. CISA added the CVE to the KEV catalog on 2026-11-10, the same day NVD published it. CISA's SSVC assessment in the NVD record marks exploitation as active, technical impact as total, and automatable as no.
CISA notes that the flaw could affect several web browsers built on Chromium, including Google Chrome, Microsoft Edge, and Opera. It is not known whether the flaw has been used in ransomware campaigns. The Chromium issue tracker entry is currently access-restricted, so no public technical details are available beyond the vendor and NVD descriptions.
What's Vulnerable
- Google Chrome versions earlier than 157.0.8103.50 (NVD CPE:
cpe:2.3:a:google:chrome:*, version end excluding 157.0.8103.50) - Other Chromium-based browsers may also be affected, per CISA, including Microsoft Edge and Opera. The supplied data does not list fixed versions for those browsers.
Patch Status
Google has fixed the flaw in Chrome 157.0.8103.50, announced in its Stable Channel Update release notes. Update Chrome to this version or later. Users of other Chromium-based browsers should apply their vendor's corresponding update.
CISA's required action is to apply mitigations according to the vendor's instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Where no mitigations are available, organizations should follow the BOD 26-04 guidance for cloud services or stop using the product. Organizations must also assess how exposed each asset is to the internet. The KEV remediation due date is 2026-11-24.