Google Chrome: use-after-free in XML (CVE-2026-125350) exploited in the wild, update released
Published 10/11/2026 15:30 · Updated 11/11/2026 19:14 (revision 3)
Timeline
4 events over 14 d
- 28/10/2026ConfirmedCERT-FR advisories+13 d
- 10/11/2026ExploitedCISA Known Exploited Vulnerabilities+14 h
- 10/11/2026 15:30Published on WatchtowerPro CISO+1 d 3 h
- 11/11/2026 19:14UpdatedCERT-FR reported on 10/11/2026 that Google says CVE-2026-125350 is actively exploited.
In short
Google has released an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in Chrome's XML handling. Google is reported to be aware of an exploit in the wild, which makes it a zero-day. Update Chrome and restart the browser. GreyNoise reports a public exploit for CVE-2026-125350; listed by CISA as known exploited (11/11/2026).
How bad is it
High. An attacker could exploit a memory-handling bug in the browser's XML processing, and the flaw is reported as used in real attacks; the exact steps an attacker needs are not stated.
Being exploited - on CISA's known-exploited list since 10/11/2026.
Severity score
CVSS 3.1 from NVD, from the vendor, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: memory corruption.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Google Chrome: a Stable post relayed by a third-party project rates CVE-2026-125350 High, as 'Use after free in XML'; the affected version range is not stated.
- A Chromium-based browser (Shuttle) and a project wrapping the Circa engine describe the same CVE as a libxslt use-after-free; the Circa note says its shipped 156.0.8078.88 engine is exposed.
What to do now
- Update Chrome to the newest stable build and restart the browser. Google's 09/11/2026 post as relayed maps build 157.0.8103.50; confirm the exact fixed build against Google's own release notes.
- If you use Shuttle, update to 158.0.1 (based on Chromium 158.0.8127.31).
- If you embed the Circa engine, the note says 156.0.8078.96 or later is needed for the fix.
- Until updated, disabling XSLT is one third-party interim measure. Interim measures reduce exposure and do not make a system safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer, all 12 sources with their dates and every revision. And technology matching: which of your systems run Google Chrome, at which version, fixed or not - and what each one needs.
Main sources
Multiples vulnérabilités dans Google Chrome (28 octobre 2026) CERT · [UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere Schwachstellen CERT · [NEU] [hoch] Google Chrome: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff CERT