[Urgent] Google Chrome (Chromium) CVE-2026-125350: Added to CISA KEV on Nov 10 — Use-After-Free in XML Handling May Let a Crafted Web Page Run Code Inside the Sandbox; Chrome 157.0.8103.50 and Later (Extended Stable 156.0.8078.96 and Later) Are the Fixed Releases (CVSS v3.1 8.8)

CVE-2026-125350, a flaw in Chromium, the browser engine behind Google Chrome, was added to the KEV catalog of CISA, the US cybersecurity agency, on November 10, 2026. KEV lists vulnerabilities that have actually been exploited. In its November 9 release post, Google wrote that it is aware that an exploit for CVE-2026-125350 exists in the wild. According to the NVD description, it is a use after free (a bug that reuses memory after it has been freed) in XML handling, and opening a crafted HTML page may let an attacker run arbitrary code inside the browser sandbox (an isolated area).

First, update Chrome to the latest version and restart the browser. The first version with the fix is 157.0.8103.50 (.50/.51 on Windows and Mac, .50 on Linux), released on November 9. On November 11, a newer 157.0.8103.78/.79 (.78 on Linux) followed. On the long-term enterprise channel, Extended Stable (Windows and Mac only), 156.0.8078.96, also released on November 9, includes the fix for this flaw. NVD also lists the affected Chrome versions as "prior to 157.0.8103.50." Google says new versions roll out over days or weeks, so if the update does not appear yet, check again later.

Where the score comes from: 8.8 (CVSS v3.1) is the value from CISA-ADP (CISA's supplemental assessment) listed in the NVD. The vector is: network, low complexity, no privileges required, user interaction required, scope unchanged, high impact on confidentiality, integrity and availability. As of our check on November 12, this was the only CVSS entry in the NVD (we did not see a score from NIST itself). In CISA's SSVC assessment, exploitation is "active", automatable is "no", and technical impact is "total". Chromium rates it "High".

What is happening (as far as it has been published)

• ▸CVE-2026-125350: a use after free in Chrome's XML handling. Google's post says "Use after free in XML" with severity "High". The weakness type is CWE-416. It was reported by Arni Hardarson (Neonix Security) and an anonymous reporter
• ▸What "inside the sandbox" means: the browser keeps the part that runs web pages in an isolated area (the sandbox), apart from the rest of the computer. The NVD description says code can run inside that area. Getting out of the sandbox usually takes another vulnerability, but the sources we could confirm do not say whether this attack used one
• ▸What triggers it: the NVD description says a "crafted HTML page." The vector requires user interaction (such as opening a page). Visiting an attacker's page or a compromised site may be enough to meet the condition
• ▸CISA's KEV: added November 10; the due date for US federal agencies is November 24. CISA writes that it may affect several Chromium-based browsers, including Chrome, Microsoft Edge and Opera

What to do today

• ✓★Update Chrome and restart it. Open the menu at the top right, then "Help" → "About Google Chrome" (or type chrome://settings/help in the address bar) to start the update check. Even after the update finishes, you stay on the old version until you press "Relaunch." Stable 157.0.8103.50 or later, or Extended Stable 156.0.8078.96 or later, has this fix (on Stable, 157.0.8103.78/.79 has been the newest since November 11). On Linux, update Chrome with your package manager instead of the menu (per Google's help page), then restart the browser
• ✓★If you use Microsoft Edge, check Microsoft's release notes. On November 9 Microsoft wrote that it was aware of exploitation and preparing a fix, and on November 11 it shipped the fix in Edge for Android (157.0.4341.53). However, as of November 12, we could not find a fixed desktop Edge version in the official notes. Install the update when it appears (you can check at edge://settings/help)
• ✓Check other Chromium-based browsers such as Brave, Opera and Vivaldi. CISA says several browsers may be affected, but we did not check each vendor's fix status
• ✓On Android, check for the Chrome update in Google Play. Google released 157.0.8103.78 for Android and says it will become available on Google Play over the next few days
• ✓If you manage work or school computers, confirm the browser update has been distributed and restarted. A browser left open keeps running the old version until it restarts
• ✓Until you have updated, do not open links from sites you do not know. Be especially careful with links in email, SMS and social media direct messages

What we could not confirm

• ▸The scale of attacks and who is behind them. Google only says an exploit exists in the wild; the sources we could confirm had no counts or attacker details
• ▸Whether a sandbox escape was actually used. The NVD description covers code execution inside the sandbox
• ▸Fixed versions for desktop Edge, Brave, Opera and Vivaldi. We found no desktop entry in Edge's official notes, and we did not check the other three
• ▸Chrome on iPhone. We did not check it for this article
• ▸Damage in Japan. This article cannot show it
• ▸A score from NIST. As of November 12, the NVD had only CISA-ADP's 8.8

Three lines to share

• ▸CVE-2026-125350 in Chromium (behind Google Chrome and others) was added to CISA's "known exploited" catalog (KEV) on November 10. Google says an exploit exists in the wild
• ▸★Update Chrome from "Help" → "About Google Chrome" and always restart it. Stable 157.0.8103.50 or later, or Extended Stable (Windows and Mac) 156.0.8078.96 or later, is the fixed release (the newest Stable since November 11 is 157.0.8103.78/.79)
• ▸Check updates for Edge and other Chromium-based browsers too. As of November 12, we could not find a fixed desktop Edge version in the official notes

Pages we relied on