Do first: Upgrade to a fixed version: 157.0.8103.50.

Summary

Google Chrome is affected by a use-after-free bug in its XML handling. A remote attacker could run arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

cve.now Index

  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach20/20Affects Google Chrome (software on nearly every server, desktop or phone)
  • Severity7/10Rated high by Chrome
  • No patch0/5No signal

What would change the score

  • Would score about 82 if added to CISA KEV
  • Would score about 77 if CISA's SSVC rates exploitation active
  • Would score about 49 if advisories confirm default setups are exposed

How the score works · Rankings

What to do

  • Upgrade to a fixed version: 157.0.8103.50.

Upgrade to a fixed version: 157.0.8103.50.

Check your systems with an agent

Paste this into a coding or ops agent. It checks your systems read-only and reports a table per asset.

Timeline

  1. Nov 9, 2026, 8:02 PM UTCcve.now early warning

    Google patches Chrome XML zero-day reported as exploited in attacks

    1 day
  2. Nov 10, 2026, 5:20 PM UTCCVE published
  3. Nov 10, 2026, 5:27 PM UTCFirst seen by cve.now
  4. Nov 10, 2026, 5:45 PM UTCPosted on X by cve.now

Google patches Chrome XML zero-day reported as exploited in attacks

Affected versions

  • Google Chrome

    From 157.0.8103.50 · fixed in 157.0.8103.50

From 157.0.8103.50 · fixed in 157.0.8103.50

Evidence 4

CVE record · 2

Establishes: The identifier and description.

  1. RecordCVE List · CVE-2026-125350
  2. RecordNVD · CVE-2026-125350

Other links · 2

  1. Linkchromereleases.googleblog.com · 2026/11/stable-channel-update-for-desktop_018223192.html
  2. Linkissues.chromium.org · issues/582442907

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-125350

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Chrome: from 157.0.8103.50 before 157.0.8103.50.Source: cve.now feed data

Upgrade to a fixed version: 157.0.8103.50.Source: cve.now feed data

Sources

Related

More vulnerabilities