KEV · Actively exploited

CVE-2026-125350

CVE-2026-125350 is actively exploited (CISA KEV catalog) : high severity (CVSS 8.8), 2 tracked apps concerned, 1 still exposed on its current version.

Severity (CVSS): 8.8
Exploitation: Confirmed
Tracked apps: 2
Still exposed: 1

Published on 2026-11-10

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Added to KEV: 2026-11-10
Remediation deadline: 2026-11-24
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware: Unknown (not documented by CISA)

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

Chrome macOS com.google.Chrome

Affected <157.0.8103.50 Fixed in 157.0.8103.50 Latest tracked 157.0.8103.39 still vulnerable

Observed affected builds (60)

157.0.8103.39 156.0.8078.80 156.0.8078.48 155.0.8059.85 155.0.8059.40 154.0.8037.98 154.0.8037.93 154.0.8037.58 153.0.8010.53 153.0.8010.48 153.0.8010.37 152.0.7977.83 152.0.7977.76 152.0.7977.65 151.0.7922.174 151.0.7922.170 151.0.7922.138 151.0.7922.109 151.0.7922.76 151.0.7922.72 150.0.7871.187 150.0.7871.182 150.0.7871.129 150.0.7871.125 150.0.7871.115 150.0.7871.101 150.0.7871.47 149.0.7827.201 149.0.7827.197 149.0.7827.156 +30 · see history
Google Chrome Windows winget:Google.Chrome

Affected <157.0.8103.50 Fixed in 157.0.8103.50 Latest tracked 157.0.8103.51 patched

Observed affected builds (15)

157.0.8103.39 156.0.8078.80 156.0.8078.74 156.0.8078.48 155.0.8059.85 155.0.8059.40 154.0.8037.98 154.0.8037.93 154.0.8037.58 153.0.8010.53 153.0.8010.48 153.0.8010.37 152.0.7977.83 152.0.7977.76 152.0.7977.65

Vulnerable CPE configurations (2)

Vendor	Product	Platform	Versions	CPE 2.3 URI
google	chrome All platforms (wildcard)	All platforms (wildcard)	<157.0.8103.50	cpe:2.3:a:google:chrome::::::::
google	chrome All platforms (wildcard)	All platforms (wildcard)	<157.0.8103.50	cpe:2.3:a:google:chrome::::::::

View on NVD ↗ CISA KEV catalog ↗ Advisory · chromereleases.googleblog.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM