CVE-2026-125350: Use-After-Free Zero-Day in Google Chrome

Chromium has rated the vulnerability as High with a CVSS score of 8.8 and has been added to CISA Kev [2]

The bug is in libxslt, the XSLT library Chrome bundles to transform XML documents with stylesheets.
Exploitation can occur through web content and does not require the victim to download or open a malicious file. An attacker could deliver the exploit through a malicious or compromised website, including attacker-controlled content embedded through frames or advertisements.

Be aware that code that runs through this bug only runs inside the renderer sandbox. To install malware or reach the rest of the PC, an attacker needs a second bug that escapes the sandbox. Exploits used in the wild against Chrome usually come as such chains, so treat an exploited renderer as a possible full compromise until you have checked.

CVE

CVE-2026-125350

Affected Products

Affected products include:
Chrome for Windows and Mac: below 157.0.8103.50
Chrome for Linux: below 157.0.8103.50
Chrome Extended Stable for Windows and Mac: below 156.0.8078.96
Chrome for Android: below 157.0.8103.50
Chrome 158 Early Stable (Windows): 158.0.8127.18/.19 and builds below 158.0.8127.30
ChromeOS Stable: 156.0.8078.93 (November 6) and earlier

Microsoft Edge: below the fixed build (157.0.4341.46 is the newest build; Microsoft has not yet tied it to this CVE)

Be aware of the following:
Early Stable Chrome 158: On November 4 Google pushed 158.0.8127.18/.19 to a small share of Windows users. Its version number is higher than 157.0.8103.50, but it was built before the fix. In the Chromium source, the first 158 build that carries the fix is 158.0.8127.30. A scanner that only checks “below 157.0.8103.50” will mark those PCs safe.

Chrome for iOS: Uses Apple’s WebKit engine, not Chrome’s own, and Google lists no iOS fix.

Exploitation

Google has stated they are aware that an exploit for CVE-2026-125350 exists in the wild[3], however has not provided any further details on who is exploiting it, who was targeted, nor whether the attackers paired it with a second bug to escape the sandbox

Recommended Actions

The following actions are recommended:

• Update Chrome to 157.0.8103.50 or later
• Disable XSLT where you cannot update straight away. Chrome 146 and later and Edge 147 and later support the XSLTEnabled policy. Set to false, it turns off the XSLTProcessor API and XSL processing instructions, which is the only way into the vulnerable code
• Update Edge to 157.0.4341.46 or later and keep XSLT disabled there until Microsoft confirms which build fixes CVE-2026-125350.
• Update other Chromium browsers and headless Chromium as vendors ship fixes.
  Detection

Truesec has conducted Threat Hunts to look for any signs of potential exploitation.

As Google has published no indicators, these hunts look for vulnerable browsers for customers with Managed Threat Exposure, and hunts have been conducted for what an exploited browser does: crash, load XSLT from the internet, start programs and write files.

References

[1] https://threatdefence.com/article/google-chrome-cve-2026-125350-zero-day-patching-hunting
[2] https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
[3] https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html