Google has patched CVE-2026-125350, an actively exploited use-after-free in Chromium’s XML processing. A hostile webpage is enough to reach the bug: the victim must browse to it, but the attacker needs no account, local access, or elevated browser privilege. Google says an exploit exists in the wild, although it has not identified the attacker, victims, targets, delivery infrastructure, or indicators of compromise.
Chromium is Google’s open-source browser project, the basis for Chrome and other browsers. The vulnerable code sits in its bundled libxslt library, which processes XSLT transformations of XML documents. That makes this relevant both to people running a browser themselves and to IT teams managing Chrome or Chromium-derived browsers across employee, student, kiosk, and shared-device fleets.
A stale XML object becomes a memory-safety bug
A use-after-free occurs when software continues to use memory after that memory has been released or replaced. Here, Chromium’s XML/XSLT matching code cached an XPath object, then evaluated another XPath expression. That evaluation could re-enter the same function and free or replace the cache entry. When the original call resumed, it tried to free the stale object, creating a double-free/use-after-free condition.
The result, according to the affected-product description, is arbitrary code execution inside the browser sandbox through crafted HTML. That distinction matters: the available material does not confirm that observed attacks escaped Chrome’s sandbox into the operating system, nor whether the in-the-wild exploit used a sandbox escape at all. Code execution within a renderer is still a strong foothold and can be chained with another flaw.
The Chromium patch fixes this by re-reading the cache entry after the potentially re-entrant evaluation and immediately before freeing it, rather than trusting the pointer captured earlier. The same change also addressed CVE-2026-125346; teams should treat this as a browser release to deploy, not a one-off configuration workaround.
Exploitation raises the patching priority
CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities catalogue on November 10, with a November 24 federal remediation due date; its entry also warns that Chromium-derived browsers may be affected and lists known ransomware use as unknown. The CVE record was published November 10, after Google received the anonymous report on November 6.
No functional public exploit or working arbitrary-code-execution proof of concept could be confirmed as of November 11. Public regression material is intended to crash an unpatched browser, not demonstrate exploitation. There is likewise no publicly identified campaign, sector-specific victim set, or named threat actor.
Deploy the vendor’s channel-specific builds
For Chrome Stable, Google fixed Windows and macOS in 157.0.8103.50 or .51, and Linux in 157.0.8103.50. Android Stable is fixed in 157.0.8103.50; Windows and macOS Extended Stable users need 156.0.8078.96. Do not infer safety from a larger-looking prerelease version: validate the actual channel build against Google’s release guidance.
Force or accelerate updates, restart browsers so the new binary loads, and use fleet inventory to find unmanaged exceptions. Debian’s Chromium package was still marked vulnerable and unfixed when checked November 11. Edge and Opera may share exposure, but CVE-specific fixed versions could not be confirmed; obtain each vendor’s patched build rather than assuming Chrome’s version applies.
This is emergency endpoint hygiene, especially for businesses, schools, and any organisation that standardises on a Chromium browser. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, helping teams turn an actively exploited browser flaw into a tracked remediation task.
