# Google Chrome CVE-2026-125350 (use after free in XML): detection pack

A use after free in Chrome's XML component, fixed in the Chrome Stable and Extended Stable updates of 9 Nov 2026.
**Google rates it High.** It is not rated Critical, and there is no CVSS score yet.
**CISA added it to KEV on 10 Nov 2026, due 24 Nov 2026.** Google had already said an exploit exists in the wild; the
KEV listing is a further government listing, not the first sign of exploitation.

> **Status of this pack.** The KQL in `kql/` and the converted Sigma in `sigma/converted/` have NOT been run against a
> live Sentinel or Defender tenant. They parse cleanly offline (see Gates), but test and tune them before you rely on
> them. Google has published no indicators of compromise and no attack details. Every hunting pattern here is our own,
> and items we could not confirm are marked [UNVERIFIED].

## Exploitation, in Google's words

> "Google is aware that an exploit for CVE-2026-125350 exists in the wild."

That sentence is all Google has said. It gives no attack details, targets or indicators. This pack does not add any.

## Facts (primary sources, checked 10 Nov 2026 07:01 to 07:16 GMT, rechecked 07:19 GMT; KEV, NVD, cve.org and other browsers rechecked 19:08 to 19:12 GMT)

| Item | Value | Source |
|---|---|---|
| CVE | CVE-2026-125350, "Use after free in XML", Chromium bug 582442907 | Chrome Releases, Stable desktop post, 9 Nov 2026 |
| Severity | **High** (Google's rating). No CVSS score anywhere | Chrome Releases. cve.org: record published 10 Nov 2026 17:20 GMT by Google's Chrome CNA, "(Chromium security severity: High)", CWE-416, no CVSS and no CISA ADP entry. NVD: published 10 Nov 2026 18:17 GMT, status "Undergoing Analysis", no CVSS metrics (checked 19:08 GMT) |
| CVE description | "Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page." | cve.org and NVD |
| Reported | "Reported by anonymous on 2026-11-06" | Chrome Releases |
| Exploited | "Google is aware that an exploit for CVE-2026-125350 exists in the wild." | Chrome Releases, Stable desktop post |
| CISA KEV | **Listed.** Added 10 Nov 2026, due date 24 Nov 2026, as "Google Chromium Use-After-Free Vulnerability" (CWE-416). Known ransomware use: Unknown. Forensic triage: No. Catalogue version 2026.11.10, released 10 Nov 2026 19:03 UTC (19:03 GMT), 1779 entries, fetched 10 Nov 2026 19:08 GMT. (At 07:01 and 07:19 GMT it was not yet listed; catalogue then was 2026.11.09.) | CISA KEV JSON feed |
| KEV description | "Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." | CISA KEV JSON feed |
| Fixed, Stable (Windows, Mac) | 157.0.8103.50/.51 | Chrome Releases, Stable desktop post |
| Fixed, Stable (Linux) | 157.0.8103.50 | Chrome Releases, Stable desktop post |
| Fixed, Extended Stable (Windows, Mac) | 156.0.8078.96 (Google's post names Windows and Mac only) | Chrome Releases, Extended Stable post, 9 Nov 2026 |
| Fixed, Android | 157.0.8103.50. "Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 157.0.8103.50/.51 Linux: 157.0.8103.50) unless otherwise noted." | Chrome for Android update post, 9 Nov 2026 |
| Rollout | "will roll out over the coming days/weeks" (Stable and Extended Stable). Android: "available on Google Play over the next few days" | Chrome Releases |
| Same release | 9 security fixes: CVE-2026-125350 plus six other High (WebGL, FileSystem, Compositing, GPU, V8, and a second XML use after free, CVE-2026-125346) and two Medium (both GPU). Google does not say any other is exploited | Chrome Releases, Stable desktop post |
| Relaunch | "The update applies the next time you restart Chrome." | Google Chrome Help, "Update Google Chrome" |
| ChromeOS | The November ChromeOS Stable post does not mention CVE-2026-125350 [UNVERIFIED whether ChromeOS is affected] | Chrome Releases |

**About ".50/.51".** Windows and Mac received 157.0.8103.50 or 157.0.8103.51; Linux received 157.0.8103.50. Both are
fixed. Treat 157.0.8103.50 and anything later in 157.0.8103.x as fixed on every platform; do not require .51.

**KEV.** CISA added CVE-2026-125350 to KEV on 10 Nov 2026 with a due date of 24 Nov 2026. CISA's required action:
"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing
Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in
Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are
unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD
26-04 patching guidelines." The due date binds US federal civilian agencies under BOD 26-04 only. It is not a deadline
for anyone else: Google says an exploit exists in the wild, so patch now regardless.

**[news] context (secondary, not from Google).** SecurityWeek (10 Nov 2026 06:12 GMT) calls this the eighth exploited
Chrome zero-day of 2026. Google does not state that count.

## Other Chromium browsers (checked 10 Nov 2026 07:01 to 07:02 GMT; rechecked 19:09 to 19:12 GMT)

| Browser | Status | Source |
|---|---|---|
| Microsoft Edge | **No fixed build yet** (unchanged at 19:09 GMT). Microsoft's 9 Nov 2026 note: "Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix." Latest listed builds: Edge Stable 157.0.4341.42 (5 Nov) and Edge for Android and iOS 157.0.4341.42 (9 Nov); neither names CVE-2026-125350 | Microsoft Edge security release notes, learn.microsoft.com |
| Brave | **v1.99.56 (10 Nov 2026): "Upgraded Chromium to 157.0.8103.50."** That is Google's fixed Chromium build, but Brave's note does not name CVE-2026-125350. Earlier v1.99.55 (5 Nov 2026) is on Chromium 157.0.8103.39 | brave.com/latest |
| Opera | **Opera 140 Stable, 140.0.6074.17 (10 Nov 2026): "Fixed a security vulnerability (CVE-2026-125350)."** It stays on Chromium 157.0.8103.39 with the fix cherry-picked (changelog: "Cherry-pick CVE-2026-125350"), so do not judge Opera by its Chromium number | blogs.opera.com/desktop, Opera 140 Stable post and changelog for 140 |
| Others (Vivaldi, Chromium distro packages, Electron apps, WebView2) | Not checked | |

The checkers still report every non-Chrome browser as UNKNOWN: they do not encode the Brave or Opera builds above, so
check those against the vendor notes by hand. When Microsoft releases a fixed Edge build, add it to the checkers and to
`EdgeFixed` in KQL Q1.

## Patch first

**Google's advice:** update to the builds above. Google's help page says the update applies the next time Chrome
restarts (About Google Chrome, then Relaunch). Google gives no workaround and no mitigation other than updating.

**Our own advice (not from Google):**
* Push the update through your RMM, Intune or Group Policy now rather than waiting for Google's staged rollout.
* Force a relaunch. Chrome can download the fix and keep running the old build until it restarts. Use your browser
  management policy for relaunch notifications or a deadline, or schedule a restart. Then confirm with KQL Q1d and Q2
  or with the checkers' `--processes` input.
* List every endpoint below 157.0.8103.50 (Stable) or 156.0.8078.96 (Extended Stable) with KQL Q1 and Q1b, or with
  the checkers on an RMM or Intune export.
* Watch the Edge security release notes and patch Edge as soon as Microsoft ships a fix. Move Opera to 140.0.6074.17
  or later and Brave to v1.99.56 or later, check any other Chromium browser you allow, and block the ones you cannot
  keep patched.
* Run the hunts below on endpoints that browsed on an unpatched build. If one hits: isolate the host, patch and
  relaunch the browser, end its browser and SSO sessions, keep the evidence, and hunt again if indicators come out.

## Contents

| Path | What it is |
|---|---|
| `kql/chrome-cve-2026-125350-hunting.kql` | 17 hunts. Q1 to Q1e inventory (TVM verdicts, device list, TVM CVE mapping, running Chrome versions from process telemetry, Chrome builds written to disk); Q2, Q2b updated but not relaunched; Q3 to Q3c browser starting shells, script hosts or LOLBins (Windows, rare pairs, macOS and Linux); Q4, Q4b renderer crash spikes [UNVERIFIED]; Q5, Q5b files written by a browser then run; Q6 to Q6c persistence after browser activity (Run keys, tasks, services, LaunchAgents, cron, systemd, autostart) |
| `sigma/*.yml` | 5 rules: Windows browser child process, Linux and macOS Chrome starting a shell, Run key written by a browser, script or HTA file written by a browser |
| `sigma/converted/` | Kusto output for no pipeline, microsoft_xdr, microsoft_365_defender, sentinel_asim and azure_monitor |
| `scripts/check-chrome.sh`, `scripts/Check-Chrome.ps1` | Read-only offline checkers with identical output and exit codes |
| `tests/` | Bash tests, Pester tests (including a bash vs PowerShell parity check), offline KQL parse check, synthetic fixtures, `run_all.sh` |

ATT&CK techniques the hunts look at: T1189 Drive-by Compromise, T1203 Exploitation for Client Execution,
T1059.001/.002/.003/.004/.005, T1218.005, T1218.011, T1204.002, T1547.001, T1053.005, T1543.003.

### KQL notes

* Not run against a live tenant. `tests/kql_parse.ps1` parses every query with Kusto.Language against the table
  columns it lists; that catches syntax errors and unknown columns in that list, nothing more.
* Q1, Q1b and Q2 need Defender Vulnerability Management (`DeviceTvmSoftwareInventory`). Q1c stays empty until
  Microsoft maps CVE-2026-125350 in its catalogue (not checked).
* Q1d and Q2 read `ProcessVersionInfoProductVersion` and `InitiatingProcessVersionInfoProductVersion`. Windows
  sensors fill these; macOS and Linux may leave them empty.
* Q2b relies on Chrome staging `new_chrome.exe` until relaunch on Windows [UNVERIFIED for Chrome 157].
* Q3 marks native messaging hosts (cmd.exe with `chrome-extension://` and `--parent-window=`) as TUNING, not as safe:
  an attacker can copy that shape. Q3b, Q5 and Q6 exclude browser updaters; that is tuning too.
* Q4 needs Crashpad dump writes in `DeviceFileEvents`, and Q4b needs the Windows Application log in the Sentinel
  `Event` table. Many tenants have neither [UNVERIFIED].
* In Sentinel with the Defender XDR connector, use `TimeGenerated` if `Timestamp` is not present.

### Sigma conversion (sigma-cli 3.1.0, pySigma Kusto backend)

`sigma check`: 0 errors, 0 condition errors, 0 issues.

* All 5 rules convert with no pipeline, `microsoft_xdr`, `microsoft_365_defender` and `sentinel_asim`. The Defender
  pipelines map them to `DeviceProcessEvents`, `DeviceRegistryEvents` and `DeviceFileEvents`; `sentinel_asim` maps
  them to `imProcessCreate`, `imRegistry` and `imFileEvent`.
* `azure_monitor` converts 4 of 5. It maps everything to `SecurityEvent`, a Windows table, so its Linux and macOS output
  is not usable, and its Windows output needs process creation (4688) or object auditing with command lines. The Run key
  rule does not convert there (SecurityEvent has no field for the registry `Details` value); `run_all.sh` expects exactly
  that one gap and fails on any other.
* The Defender pipelines match `Image` and `ParentImage` against `FolderPath` and `InitiatingProcessFolderPath` with
  `endswith`, and `TargetFilename` against `FolderPath`. Check these columns hold the full path including the file
  name in your tenant. KQL Q3 and Q5 use `FileName` and `InitiatingProcessFileName` instead.
* The "no pipeline" output uses Sigma field names (`Image`, `ParentImage`) that no Microsoft table has. Treat it as a
  reference only.

## Checkers

Strictly read-only and offline: they read only the values and files you pass, never touch the network, never write
files and never start a browser. Bash and PowerShell versions print identical output and exit codes.

```
scripts/check-chrome.sh --version 157.0.8103.51 --platform windows
scripts/check-chrome.sh --version 157.0.8103.50 --running 157.0.8103.39
scripts/check-chrome.sh --inventory browsers.csv --processes running.csv
pwsh scripts/Check-Chrome.ps1 -Inventory browsers.csv -Processes running.csv
```

* `--inventory` CSV header `host,browser,channel,version`, for example from an RMM or Intune export.
  Channel is `stable`, `extended` (also `extended stable`), `beta`, `dev` or `canary`; blank means stable.
* `--processes` CSV header `host,process,version`, one row per running browser process you saved (for example from
  `Get-Process chrome | Select-Object Path, FileVersion`, `ps`, or KQL Q1d). Rows without a four part version are skipped.
* `--running` is the single host form of `--processes`.

| Exit | Verdict | Meaning |
|---|---|---|
| 0 | PATCHED | Chrome at 157.0.8103.50 or later in 157.0.8103.x, 156.0.8078.96 or later in 156.0.8078.x, or 158 to 199 |
| 1 | VULNERABLE | Chrome below the fixed build for its line |
| 2 | NEEDS RELAUNCH | Installed build is fixed, but a saved running Chrome process is on an unfixed build |
| 3 | UNKNOWN | Edge or another Chromium browser (no fix confirmed), Beta, Dev or Canary channel, Extended Stable on Linux or Android, or a version this pack cannot judge (for example 157.0.8104.x or a non zero second number) |
| 4 | usage or read error | Bad arguments, unreadable file, wrong CSV header, or no data rows (stdout stays empty) |

For an inventory the exit code is the worst row: VULNERABLE, then NEEDS RELAUNCH, then UNKNOWN, then PATCHED.
The checkers judge version numbers only. They cannot tell whether a host was attacked; use the hunts for that.

## Gates (run `tests/run_all.sh`; any failing gate stops it with a non-zero exit)

ShellCheck; PSScriptAnalyzer; bash tests; Pester tests with bash vs PowerShell parity on every case; guards (no
network or write primitives in the checkers, every fixture marked FIXTURE_ONLY, only RFC 5737 IPs, no em or en dashes);
bubblewrap sandbox runs of both checkers for every verdict with no network and a read-only filesystem, with a sha256 of
the pack before and after; offline KQL parse; `sigma check`; `sigma convert` on five pipelines, compared with
`sigma/converted/`.

Fixtures in `tests/fixtures/` are synthetic (FIXTURE_ONLY, RFC 5737 addresses). They are not indicators of compromise.

## Not verified

* Which Edge build will fix this, and whether Vivaldi, Electron apps or WebView2 are affected. Brave's note gives the
  fixed Chromium number but does not name the CVE.
* Whether ChromeOS is affected (its November post does not mention this CVE).
* Any CVSS score: none from Google, the CVE record or NVD at 19:08 GMT.
* Google's attack details: none published. No IOCs exist in this pack.
* Q2b (`new_chrome.exe` staging), Q4 and Q4b (crash telemetry) depend on behaviour and data we have not confirmed.