XML use-after-free
Google identifies a use-after-free in Chrome’s XML component.
Chrome fixes an exploited XML use-after-free in a new desktop update
Google says an exploit for CVE-2026-125350 exists in the wild. The November 9 Chrome Stable rollout fixes the XML use-after-free alongside other security bugs. Relaunch Chrome after the update to load the patched build.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- 1 CVE tracked here
- Splash zone
- Desktop Chrome Stable on Windows, macOS and Linux below the November 9 patched build.
- Chrome · browser · use-after-free
- In the wild
- Yes
- Google reports a live exploit. CISA added the flaw to KEV on November 10.
What happened
This is a later Stable release than the November 3 Chrome batch. Google lists the flaw as High and has not published the full delivery chain, exact interaction requirements or victim scope in its announcement. Confirm the build on each desktop platform and track browser derivatives through their own vendors.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Chrome Stable for Windows and macOS | 157.0.8103.50/.51 | |
| Chrome Stable for Linux | 157.0.8103.50 |
Crime-scene timeline
Nov 9, 2026
Google announces the Chrome Stable update
Google says it knows of an exploit for the XML bug in the wild.
Nov 10, 2026
CISA adds CVE-2026-125350 to KEV
The catalog lists November 24 as the due date for applicable U.S. federal civilian agencies.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Chrome Stable release announcementPrimaryNovember 9 platform builds, XML use-after-free and confirmation of an exploit in the wild.
- CISA KEV catalogPrimaryConfirms known exploitation and the listed federal remediation deadline.