Chrome CVE-2026-125350 use-after-free exploited, added to CISA KEV

CISA has added a Chromium use-after-free flaw, CVE-2026-125350, to its Known Exploited Vulnerabilities catalog, according to the CISA KEV entry. The bug is a Chrome vulnerability that is being exploited, and federal agencies have until 24 November 2026 to apply the fix. Update Chrome to 157.0.8103.50 or later now.

What happened

CISA listed the flaw on 10 November 2026 under the name “Google Chromium Use-After-Free Vulnerability”. The bug sits in Chromium’s XML component. A remote attacker who gets a user to open a crafted web page can run arbitrary code inside the browser sandbox. NVD scores it CVSS 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and maps it to CWE-416, use after free.

Google’s Stable Channel update for desktop of 9 November 2026 carries the fix. Google rates the issue High under its own Chromium severity scale.

The KEV listing does not say who is exploiting the bug or against whom. CISA lists use in ransomware campaigns as unknown.

Am I affected?

You are affected if you run any of the following:

• Google Chrome earlier than 157.0.8103.50 on desktop.
• Other browsers built on Chromium. CISA notes that the flaw could affect multiple Chromium-based browsers, including Microsoft Edge and Opera. Each of those vendors ships its own builds, so check the update status of every Chromium-based product in your estate.
• Applications that embed Chromium, which depend on the vendor for an updated build.

Chrome updates itself, but the fix only applies after the browser restarts. Machines that stay open for days, shared kiosks and virtual desktops are the usual stragglers.

Why this matters

This section is analysis, not new reporting. Exploitation requires only that a user visits a crafted page (user interaction is required, privileges are not), so phishing links, malicious ads and compromised sites are all plausible delivery routes. Code execution inside the sandbox is not a full compromise on its own. Attackers normally chain a sandbox-contained bug with a second flaw to escape it, so a bug like this is often one half of a chain.

Because it is in CISA KEV, treat it as a patch-within-hours item for browsers on internet-facing user workstations, not something for the next monthly cycle.

Detection and hunting ideas

These ideas follow from the facts above and are not indicators tied to this exploit. A browser exploit leaves little on disk, so look at behaviour around the browser process.

• Browser processes launching shells, scripting hosts or unsigned binaries.
• New scheduled tasks, run keys or startup items created shortly after a user browsed to an unfamiliar site.
• Proxy or DNS logs showing a user reaching a never-seen domain just before an endpoint alert.
• Browser crashes clustered across several users, which can point to failed exploitation attempts.

Technical details

• Type: use after free (CWE-416) in the XML component.
• Attack vector: network, low complexity, no privileges, user interaction required.
• Impact: high confidentiality, integrity and availability impact within the sandbox.
• Exploitation: listed in CISA KEV on 10 November 2026, due date 24 November 2026.
• Required action in KEV: apply vendor mitigations in line with CISA’s BOD 26-04 guidance and its forensics triage requirements, or stop using the product if mitigations are unavailable.

No indicators of compromise have been published for this vulnerability.

What to do

1. Open chrome://settings/help on a sample machine, confirm the version is 157.0.8103.50 or later and relaunch the browser.
2. Use your endpoint management or browser inventory to list machines still on older builds, and push the update to them first if they are exposed to the internet.
3. Check Edge, Opera and any other Chromium-based browsers or embedded apps in your estate and apply each vendor’s update as soon as it is offered.
4. Hunt for follow-on activity: unexpected child processes spawned by the browser, new persistence on user machines and outbound connections from browsers to rarely seen hosts. These are generic detection ideas, not indicators tied to this exploit.
5. If you are a US federal agency or follow its timelines, record the 24 November 2026 deadline and the BOD 26-04 requirements.

Related coverage

• GPUStack auth bypass CVE-2026-102895 added to CISA KEV
• WordPress Core RCE flaw CVE-2026-119977 added to CISA KEV
• Linux kernel CVE-2026-46300 added to CISA KEV, exploited

Sources

• CISA KEV entry for CVE-2026-125350
• Chrome Releases: Stable Channel Update for Desktop
• NVD: CVE-2026-125350