SockAnalyst
← All playbooks
HighExploited vuln · 2026-11-10

Google Chrome CVE-2026-125350: XML use-after-free zero-day exploited in the wild, patched in Chrome 157

SockAnalyst · Security+ certified analyst.

What happened

On November 9, 2026 Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux with nine security fixes. One of them, CVE-2026-125350, is a high-severity use-after-free in Chrome's XML component reported anonymously on November 6. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild, but has not shared how it is being used or by whom, and bug details stay restricted until most users update. It is the eighth exploited Chrome zero-day of 2026. No CVSS score had been published, and it was not on the CISA KEV catalog when we checked on November 10.

Update (2026-11-11): Now on CISA KEV. CISA added CVE-2026-125350 (Google Chromium use-after-free) to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a federal due date of November 24. Chromium-based browsers such as Edge and Opera need their vendors' builds with the fix.

Who's affected

Anyone running desktop Chrome older than 157.0.8103.50 on Windows, macOS or Linux. Other Chromium-based browsers such as Microsoft Edge, Brave, Opera and Vivaldi should get the fix as their vendors ship it.

✅ Fix / patch

  • Update Chrome to 157.0.8103.50/.51 (Windows, Mac) or 157.0.8103.50 (Linux) and relaunch; the fix is not active until the browser restarts.
  • Managed fleets: push the update through your browser management policy and set a relaunch deadline so users cannot defer it for days.
  • Track Edge, Brave, Opera and Vivaldi releases and update them as soon as their Chromium 157 based builds ship.
  • Use your inventory or EDR to find hosts still reporting an older Chrome version and chase them.

🔎 Quick hunt check

Google has published no IOCs, exploit details or targeting. Hunt for hosts still running Chrome versions below 157.0.8103.50, and for chrome.exe renderer processes spawning unusual child processes such as cmd, powershell or rundll32, which can indicate a successful browser exploit chain.

MITRE ATT&CK: T1189, T1203

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=edr (process_name="chrome.exe" OR process_name="Google Chrome" OR process_name="chrome")
| eval ver=coalesce(file_version, process_version)
| rex field=ver "^(?<maj>\d+)\.\d+\.(?<build>\d+)\.(?<patch>\d+)"
| where tonumber(maj)<157 OR (tonumber(maj)=157 AND tonumber(build)<8103) OR (tonumber(maj)=157 AND tonumber(build)=8103 AND tonumber(patch)<50)
| stats latest(ver) as chrome_version latest(_time) as last_seen by host
| append [ search index=edr parent_process_name="chrome.exe" process_name IN ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","mshta.exe","wscript.exe") | stats count values(process) as cmd by host, user ]
// Hosts below Chrome 157.0.8103.50 (CVE-2026-125350 fix) plus suspicious Chrome child processes
let vuln = DeviceTvmSoftwareInventory
| where SoftwareName has "chrome" and SoftwareVendor has "google"
| extend v = parse_version(SoftwareVersion)
| where v < parse_version("157.0.8103.50")
| project DeviceName, SoftwareVersion, Detail="Chrome below 157.0.8103.50";
let kids = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","mshta.exe","wscript.exe")
| project DeviceName, SoftwareVersion="", Detail=ProcessCommandLine;
union vuln, kids
// Unpatched Chrome (CVE-2026-125350) and unusual child processes from the browser

See all hunt queries →

⏱ CISA deadline

CVE-2026-125350CVSS 8.8 High (v3.1, CNA)
--
Federal due 2026-11-24 · CISA KEV catalog

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →