CVE-2026-125350
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to...
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2026-125350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-10
EUVDEUVD-2026-121390
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Record
EUVD-2026-121390- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-rm6p-3338-xx33
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to...
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Record
GHSA-rm6p-3338-xx33- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-10
CISA KEVNo score
Google Chromium Use-After-Free Vulnerability
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Record
CVE-2026-125350- Weakness
- CWE-416
- Updated
- 2026-11-10
NVD
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2026-125350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-10
OSVALPINE-CVE-2026-125350
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Record
ALPINE-CVE-2026-125350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
OSVBELL-CVE-2026-125350
- Record
BELL-CVE-2026-125350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-12
OSVDEBIAN-CVE-2026-125350
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Record
DEBIAN-CVE-2026-125350- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-11
OSVopenSUSE-SU-2026:12509-1No score
chromedriver-157.0.8103.50-1.1 on GA media
These are all security issues fixed in the chromedriver-157.0.8103.50-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12509-1- Updated
- 2026-11-11
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxsltAlpine:v3.21 | before 1.1.42-r3 | 1.1.42-r3 |
libxsltAlpine:v3.22 | before 1.1.43-r4 | 1.1.43-r4 |
libxsltAlpine:v3.23 | before 1.1.43-r4 | 1.1.43-r4 |
libxsltAlpine:v3.24 | before 1.1.43-r4 | 1.1.43-r4 |
libxsltAlpaquita:25 | 1.1.43-r0 up to 1.1.43-r2 | 1.1.43-r2 |
libxsltAlpaquita:stream | 1.1.37-r0 up to 1.1.43-r2 | 1.1.43-r2 |
libxsltBellSoft Hardened Containers:25 | 1.1.43-r0 up to 1.1.43-r2 | 1.1.43-r2 |
libxsltBellSoft Hardened Containers:stream | 1.1.37-r0 up to 1.1.43-r2 | 1.1.43-r2 |
chromiumDebian:12 | All versions, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1 | None known |
chromiumDebian:13 | All versions, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 45 moreShow less139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1 | None known |
chromiumDebian:14 | All versions, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 45 moreShow less139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1143.0.7499.109-1 | None known |
chromiumopenSUSE:Tumbleweed From an advisory covering 9 CVEs | before 157.0.8103.50-1.1 | 157.0.8103.50-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Frostmoon39206/CVE-2026-125350-PoC | 2026-11-10 |
| PoC in GitHub | ashrafzaryouh/CVE-2026-125350 | 2026-11-10 |
| PoC in GitHub | TJT001/CVE-2026-125350-PoC | 2026-11-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| exploits, facts | PoC in GitHub | |
| affected, aliases, published, references | OSV | |
| affected, aliases, facts, references | OSV | |
| published, references, severity | CVE List, NVD, OSV | |
| references, severity | GitHub Advisories | |
| severity | EUVD | |
| exploitation | EUVD, NVD | |
| exploitation, facts, kev, products | EUVD, CISA KEV | |
| aliases, references, title | GitHub Advisories | |
| cwes | CVE List | |
| aliases, description, products, references | EUVD | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-125350 is a high vulnerability (CVSS 8.8) in Google Chrome, published November 10, 2026. CISA lists it as known to be exploited, since November 10, 2026. EUVD reports exploitation since November 10, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 62nd percentile. Fixed in libxslt 1.1.42-r3.
References
chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
issues.chromium.org/issues/582442907
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350
nvd.nist.gov/vuln/detail/CVE-2026-125350
github.com/advisories/GHSA-rm6p-3338-xx33
security.alpinelinux.org/vuln/CVE-2026-125350
Show 11 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-125350
security-tracker.debian.org/tracker/CVE-2026-125350
suse.com/security/cve/CVE-2026-125342
Left out here: 718 versions. The JSON record has them.