CVE-2026-125350

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Nov 11, 2026

Description

Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 157.0.8103.50, < 157.0.8103.50

References

https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/582442907Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350US Government Resource

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
Added to CISA KEV: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1253575.3Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_CVE-2026-1253588.1Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the CVE-2026-1253594.3Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner CVE-2026-125366.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all version CVE-2026-1253607.2Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR per CVE-2026-1253616.3Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon CVE-2026-1253623.1Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords usi CVE-2026-1253635.4MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to t CVE-2026-1253648.1frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant themselves orga roles by subm CVE-2026-1253656.5DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other use CVE-2026-1253665.4Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrar CVE-2026-1253675.4Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server