Vulnerability report

Trusted Third Party Report Confirmed Confidence In CISA KEV

CVE-2026-125350

Chrome

Google / Chrome · affected before 157.0.8103.50

Watch CVE-2026-125350 Browse KEV feed
Severity
CVSS 8.8 · High
Confidence
Confirmed
Exploit status
Trusted Third Party Report
EPSS
—
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-125350 is an unauthenticated vulnerability affecting Google Chrome.

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Google / Chrome affected before 157.0.8103.50.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Chrome

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Google Affected
Chrome
Before 157.0.8103.50
Published
10 Nov 2026
Exploitation Attempts Reported
10 Nov 2026
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
Required

Tags

cisa

CVE References

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

The Hacker News

Recorded 10 Nov 2026

A trusted third party reported exploitation attempts.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
The Hacker News First 2026-11-10 08:25 UTC
CyberInsider 2026-11-10 10:21 UTC
Security Affairs 2026-11-10 11:21 UTC
CISA 2026-11-10 19:20 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

—

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Use After Free CWE-416

Recent mention · TheRegister

Chrome zero-day whack-a-mole continues as 2026 tally hits 8

Another Chrome memory bug gets squashed, but not before attackers got their hands on it

Read full advisory

All Mentions

Recent mention · TheRegister

Chrome zero-day whack-a-mole continues as 2026 tally hits 8

TheRegister · 10 Nov 2026

Another Chrome memory bug gets squashed, but not before attackers got their hands on it

Recent mention · Security Affairs

Google fixes the eighth actively exploited Chrome zero-day of 2026

Security Affairs · 10 Nov 2026

Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, has been actively exploited in the wild. The vulnerability is a use after free issue that resides in XML and was reported […]

Recent mention · CyberInsider

Google fixes Chrome XML zero-day flaw exploited in attacks

CyberInsider · 10 Nov 2026

Google released a Chrome security update that addresses nine vulnerabilities, including a high-severity XML flaw exploited in the wild. The security update brings the Stable channel to version 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, with the rollout to users taking place over the coming days and weeks. Tracked as CVE-2026-125350, the exploited … The post Google fixes Chrome XML zero-day flaw exploited in attacks appeared first on CyberInsider.

Recent mention · The Hacker News

CVE-2026-125350

The Hacker News · 10 Nov 2026

Recent mention · Google Chrome Releases

Stable Channel Update for Desktop

Google Chrome Releases · 09 Nov 2026

 The Stable channel has been updated to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 9 security fixes. Please see the Chrome Security Page for more...

Recent mention · Google Chrome Releases

Extended Stable Update for Desktop

Google Chrome Releases · 09 Nov 2026

 The Extended Stable channel has been updated to 156.0.8078.96 for Windows and Mac which will roll out over the coming days/weeks. Security FixesNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 11 security fixes. Please see the Chrome Security Page for more information.[577327383] High CVE-2026-121068[578670966] High CVE-2026-121076[558111285] High...

Timeline

From disclosure to observed exploitation attempts

  1. 19:20 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  2. 17:20 UTC

    CVE published

    Vulnerability disclosed publicly

  3. 11:21 UTC

    KEV confirmed by Security Affairs

    Exploitation attempts reported by an external source

  4. 10:21 UTC

    KEV confirmed by CyberInsider

    Exploitation attempts reported by an external source

  5. 08:25 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party report of exploitation attempts

  6. 21:43 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-125350

Sample API response 
{
  "cve_id": "CVE-2026-125350",
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}