Is CVE-2026-125350 exploited in the wild?

Yes. CVE-2026-125350 is known to be exploited in the wild, first recorded on 10 November 2026. Treat it as urgent.

How severe is CVE-2026-125350?

Critical severity, published 10 November 2026.

Which products and versions are affected?

Google Chrome prior to 157.0.8103.50.

Is there a fix for CVE-2026-125350?

Yes: fixed in Chrome 157.0.8103.50 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125350 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125350?

Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125350: Google Chrome use after free in XML

CVE-2026-125350 · Severity: critical · Exploited in the wild · Published 2026-11-10

Google Chrome is a web browser used by billions of people to access websites and web applications. A use-after-free vulnerability in Chrome's XML parser allows attackers to execute arbitrary code inside the browser sandbox by tricking users into visiting a specially crafted webpage. Although sandboxed, exploitation could lead to data theft, credential harvesting, or further system compromise.

Technologies: Google Chrome, Google Chromium. Vendors: Google.

Quick answers

Is CVE-2026-125350 exploited in the wild?: Yes. CVE-2026-125350 is known to be exploited in the wild, first recorded on 10 November 2026. Treat it as urgent.
How severe is CVE-2026-125350?: Critical severity, published 10 November 2026.
Which products and versions are affected?: Google Chrome prior to 157.0.8103.50.
Is there a fix for CVE-2026-125350?: Yes: fixed in Chrome 157.0.8103.50 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125350 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125350?: Check whether you run Google Chrome or Google Chromium at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Chrome 157.0.8103.50 and later

Technical details

A use-after-free vulnerability exists in Chrome's XML parsing component, allowing remote code execution within the sandbox via a crafted HTML page. The vulnerability requires user interaction (visiting a malicious page) and can be exploited without authentication or special network position. Chromium rates this as High severity; a sandbox escape would be required for full system compromise.

Affected products

Google Chrome prior to 157.0.8103.50

Timeline

2026-11-09: disclosed: Reported by anonymous on 2026-11-06; fix released 2026-11-09
2026-11-09: exploited: Google aware of exploit in the wild at time of patch release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.