Google Chromium Use-After-Free Vulnerability
TL;DR 📌
- Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Listed in CISA KEV (2026-11-10) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-125350.
What it is
CVE-2026-125350 is a use-after-free vulnerability in Chromium’s XML component. The flaw is reachable by getting a target to load a specially crafted HTML page — no authentication and no local access is required. Exploitation leads to arbitrary code execution, but confined within Chromium’s sandbox.
Because the vulnerability sits in Chromium itself rather than in a single vendor’s wrapper, it affects any browser built on the same engine, including Google Chrome, Microsoft Edge, and Opera. The NVD description specifically notes Google Chrome versions prior to 157.0.8103.50 as affected; for the other Chromium-based browsers, consult each vendor’s own advisory for the corresponding fixed build.
This is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-11-10, so it is known to be exploited in the wild.
What to do
- Update Google Chrome to 157.0.8103.50 or later.
- Check Microsoft Edge, Opera, and any other Chromium-based browsers in use for their equivalent fixed releases — the NVD entry only confirms the fixed version for Chrome.
- Given the CISA KEV listing, treat this as a priority patching action rather than routine maintenance; confirm deployed browser versions across managed fleets rather than relying on auto-update assumptions, particularly on systems where browser updates may be deferred or disabled by policy.
- Where rapid patching isn’t possible, consider restricting or monitoring exposure to untrusted web content on affected browsers in the interim.
For leadership 🧭
Executive summary. Chrome, Edge, Opera and other Chromium-based browsers can be made to execute attacker code simply by loading a malicious page, and CISA confirms this is already being exploited. Because browser updates are often deferred or silently disabled on managed endpoints, this needs confirmed patching this week, not at the next routine cycle.
Why it matters:
- The flaw is in Chromium’s shared XML component, so it isn’t limited to one vendor’s browser — Chrome, Edge and Opera all inherit the same code path and the same exposure.
- No authentication or local access is required; a user simply has to open a crafted HTML page, which is one of the easiest delivery routes available to an attacker.
- It is already listed in CISA’s Known Exploited Vulnerabilities catalogue (added 2026-11-10), meaning active exploitation has been confirmed rather than theoretical.
- Only the Chrome fixed version (157.0.8103.50) is confirmed in the NVD entry — Edge, Opera and other Chromium-based browsers need separate verification, leaving a gap if those are assumed to be covered by the same fix.
Now / Next / Later:
- Now: Update Google Chrome to 157.0.8103.50 or later across all managed endpoints today, and verify actual installed versions rather than assuming auto-update has applied.
- Next: During the next change window, check Microsoft Edge, Opera and any other Chromium-based browsers in use for their own vendor-confirmed fixed builds, since the NVD entry only validates the Chrome fix.
- Later: Put a process in place to track Chromium-based browser versions across the fleet continuously, flagging any endpoints where auto-update is disabled or deferred by policy, so the next Chromium KEV entry doesn’t rely on a manual sweep.