Chromium CVE-2026-125350: use-after-free already exploited

What CVE-2026-125350 is and who it affectsGoogle Chromium carries a use-after-free vulnerability in its XML component, tracked as CVE-2026-125350 and...

What CVE-2026-125350 is and who it affects

Google Chromium carries a use-after-free vulnerability in its XML component, tracked as CVE-2026-125350 and officially named the Google Chromium Use-After-Free Vulnerability. The flaw is classified as CWE-416 and rated CVSS 3.1 8.8 (HIGH) — grave, not critical — with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

According to the National Vulnerability Database (NVD) of NIST, the affected product is Google Chrome up to 157.0.8103.50, excluding that version. The practical consequence is broader than one browser: as CISA explains, the same engine underpins several browsers built on Chromium, including but not limited to Google Chrome, Microsoft Edge and Opera. A small company in Lleida or Barcelona that standardises on Chrome, or a shop whose staff browse on Edge, may be running the vulnerable code without realising it.

The technical description is worth reading carefully. A remote attacker can trigger the use-after-free through a specially crafted HTML page and, from there, execute arbitrary code inside the sandbox. In other words, the browser's own isolation layer is not a guarantee here: the flaw lives in the component that processes XML, and a single malicious page is enough of an entry point.

Why it is urgent: already exploited, with a deadline

This is not a theoretical issue waiting for a proof of concept. CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026, which means there is confirmed exploitation in real attacks. The NVD publication date matches: 10 November 2026.

For US federal agencies, CISA set a remediation deadline of 24 November 2026 — roughly two weeks. The required action is to apply mitigations in line with the vendor's instructions, following BOD 26-04 guidance on prioritising security updates by risk and the Forensics Triage Requirements, and to discontinue use of the product where mitigations are unavailable. CISA also reminds asset owners that they are responsible for evaluating each asset's internet exposure.

Two details matter for a Spanish SME reading this. First, the KEV catalogue has no legal force in Spain, but it is the best public signal that a vulnerability is being used in the wild — treat it as a priority flag, not as foreign bureaucracy. Second, the material does not record this CVE as used in ransomware campaigns, so there is no need to assume extortion; the risk is code execution through the browser, which is serious enough on its own.

What to do today

Inventory the browsers. Check which Chromium-based browsers are installed across workstations and, above all, on any machine used to administer servers, ecommerce back offices or email. Record the exact version.
Compare against 157.0.8103.50. Anything below that build of Google Chrome is in scope. For Edge, Opera and other Chromium derivatives, the version numbering differs: consult each vendor's advisory rather than assuming the Chrome number applies.
Apply the update indicated by the vendor advisory. The material does not state a fixed release beyond the NVD threshold, so follow Google's Chrome Releases notes and each browser maker's own bulletin. Do not guess a version number.
Review for signs of intrusion. Because exploitation can execute code inside the sandbox, look at unusual browser behaviour, unexpected processes spawned from browser sessions, anomalous outbound connections and recent changes on machines that browse the web daily.
Reduce internet exposure. Where a browser cannot be updated immediately, restrict its use for sensitive tasks, limit access to internal panels and apply the mitigations CISA points to until the update lands.

Do not overlook the boring part: an unpatched browser on a marketing laptop is one thing; the same browser on the workstation that opens the PrestaShop admin, the hosting panel or the invoicing platform is quite another. Prioritise by what each device can reach.

How a cybersecurity team like ALMC's can help

Keeping a patch cycle under control across a handful of machines, a WordPress site, a PrestaShop store and a server is exactly the kind of work that slips when the IT team is one person wearing five hats. At ALMC we work on that layer: security audits and pentesting to find what is exposed before someone else does, hardening of servers, monitoring and incident response, and maintenance and updating of WordPress, PrestaShop and Joomla installations. When a site has already been hacked, we repair it and close the way in.

In the case of CVE-2026-125350, the useful contribution is not a dramatic intervention but a disciplined one: a clear inventory of browsers and versions, a documented update path following each vendor's advisory, a review of logs for the exploitation window and a realistic assessment of which assets are reachable from the internet. That is what turns a KEV entry from a headline into a closed task — and what keeps a small business in Catalonia out of the statistics.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.