Google Chrome flaw CVE-2026-125350 is on CISA's exploited list; update now

CVE-2026-125350 is a flaw in the XML component of Google Chrome. Chrome versions before 157.0.8103.50 are affected. An attacker who gets a user to open a crafted web page can run code inside the browser's sandbox. The sandbox is the isolation layer that limits what the browser can touch on the system, so this is a serious bug even though it does not on its own give full control of the machine.

The Known Exploited Vulnerabilities catalog run by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) lists this CVE. CISA added it on November 10, 2026. That listing means CISA has evidence that the flaw is being used in real attacks. Google's record does not describe those attacks, and the sources do not say who is behind them or how many organizations were hit.

What the flaw is

The bug is a use-after-free error. A use-after-free happens when a program keeps using a block of memory after it has been released. Once the memory is released, the system can hand the same space to new data. If the program then uses its old pointer, which is the address it still holds, it reads or writes data that now belongs to something else. Attackers can sometimes shape that memory to change how the program behaves.

Google rates the bug High in its own severity scale. The Common Vulnerability Scoring System (CVSS) gives it 8.8 out of 10. The main factor that lowers the score is that a user must take an action, such as opening the page. The attack needs no login, and the attack itself is considered simple.

Who is exposed

Any system running Google Chrome before version 157.0.8103.50 is exposed. CISA's listing also states that the flaw could affect other browsers built on Chromium, including Microsoft Edge and Opera. The sources do not give fixed versions for those products, so administrators should check with each vendor directly.

CISA asks organizations to judge each asset's exposure to the internet. Browsers on machines that visit untrusted sites, or that sit on exposed networks, carry the most risk.

The fix and what to do now

Google fixed the flaw in Chrome 157.0.8103.50. Update every Chrome installation to that version or later. Use the vendor's release notes to confirm the version on each managed device. Check any browser that is built on Chromium for its own advisory, because the sources do not confirm when those fixes arrived.

CISA's required action asks organizations to apply mitigations in line with Google's instructions and with its Binding Operational Directive 26-04 on risk-based patching. For cloud services, CISA says to follow the directive or stop using the product if no mitigation is available. The federal due date for this listing is November 24, 2026. Private organizations should treat that date as a useful target.