Actively exploited XML vulnerability in Chrome has been patched

Google has patched a vulnerability in Chrome’s XML component that could allow an attacker to execute code within the browser sandbox. The flaw, tracked as CVE-2026-125350, was added to CISA’s Known Exploited Vulnerabilities (KEV) list on November 10, 2026. In other words, this isn’t just a lab-only issue; it’s being used in real-world attacks.

How does the flaw work?

The root cause is a use-after-free during XML parsing (CWE-416). If a user opens a specially crafted web page, they may unknowingly create the conditions for arbitrary code execution within the browser’s security boundary. The NVD entry gives it a CVSS 3.1 score of 8.8 (High). The attack can be carried out over the network and requires no special privileges; the only condition is that the user opens the prepared page.

Which browsers are affected?

Because the flaw is in the Chromium engine, it affects not only Google Chrome but also other Chromium-based browsers such as Microsoft Edge, Opera, and Brave. The CISA entry also notes that the issue impacts multiple browsers, including Chrome, Edge, and Opera. Google fixed the problem in Chrome version 157.0.8103.50. For other browsers, the patch needs to come from the respective vendor, so version checks should be done browser by browser.

What should you do?

Chrome users should type chrome://settings/help into the address bar and confirm that their version is 157.0.8103.50 or later. The browser usually downloads updates in the background, but it needs to be restarted for the update to take effect; as long as tabs remain open, the old vulnerable version keeps running. In enterprise environments, Chrome and Edge deployments should be checked through version reports, and machines that have not received the update should be handled separately.

CISA has set November 24, 2026 as the remediation deadline for federal agencies. Since the flaw is linked on the KEV list to ransomware campaigns, delaying the patch increases the risk. For anyone using a Chromium-based browser, the fastest precaution is simple: close and reopen the browser, then install the update. On an unpatched browser, every page you visit becomes a potential attack surface.

Source: CISA KEV · NVD