High (Google)In CISA KEVExploit in the wild (Google)Chrome

Is your browser estate still exposed to Chrome CVE-2026-125350?

Google's 9 November 2026 stable-channel update rates CVE-2026-125350 High, a use-after-free in XML, and says: 'Google is aware that an exploit for CVE-2026-125350 exists in the wild.' Fixed Chrome builds are 157.0.8103.50 and 157.0.8103.51 (Windows and Mac) and 157.0.8103.50 (Linux). CISA added it to KEV on 10 November, the day after Google's post. Update now.

Google: an exploit exists in the wild. In CISA KEV. Update Chrome now

Google's 9 November 2026 Stable Channel Update for Desktop says, verbatim: 'Google is aware that an exploit for CVE-2026-125350 exists in the wild.' Google rates it High (use after free in XML); there is no CVSS score in that post. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 November 2026, with a due date of 24 November 2026, and forensicTriage No. That due date binds US federal agencies only. Our advice, for everyone, is to update Chrome now. The KEV addition is the day after Google's post, not the same day.

By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 22:41 GMT.

Check Exposure How to Hunt

At a Glance

Based on Google's 9 November stable-channel update, current Opera, Brave and Microsoft Edge vendor notes, and CISA KEV catalogue 2026.11.10, rechecked on 10 November 2026. Last updated 10 November 2026, 22:41 GMT.

Severity

High (Google)

Google rates CVE-2026-125350 High. The 9 November post lists no CVSS score. We do not invent one. Reported by anonymous on 6 November 2026.

Status

Exploit in the wild; in KEV

Google's words: an exploit for CVE-2026-125350 exists in the wild. CISA added it to KEV on 10 November 2026, due 24 November (US federal agencies only). forensicTriage: No.

Affected

Chrome before 157.0.8103.50

Desktop Stable: 157.0.8103.50 / .51 (Windows and Mac), 157.0.8103.50 (Linux). Extended Stable 156.0.8078.96 includes this CVE. Android 157.0.8103.50 has the same security fixes unless otherwise noted.

Fix

Update Chrome now

Install the 9 November stable build and relaunch so running processes match. See the other-browser notes below for what Opera, Brave and Edge say on their own pages today.

6 Nov 2026

Google credits an anonymous report of the use-after-free in XML.

9 Nov 2026

Google publishes the Stable Channel Update for Desktop, rates CVE-2026-125350 High, and writes: 'Google is aware that an exploit for CVE-2026-125350 exists in the wild.'

10 Nov 2026

CISA adds CVE-2026-125350 to KEV, due 24 November 2026. Opera publishes Opera 140 Stable. Brave publishes desktop v1.99.56.

Now

Update Chrome to 157.0.8103.50 or later (or Extended Stable 156.0.8078.96 or later), relaunch, and check other Chromium browsers against each vendor's own notes.

What other browser vendors say now

We rechecked the official Opera, Brave and Microsoft Edge notes on 10 November 2026, after an earlier hunt pass at 19:12 GMT. We state only what those vendor pages say now.

Opera: the official Opera 140 Stable post (10 November 2026) says Opera updated Chromium to 157.0.8103.39 and 'Fixed a security vulnerability (CVE-2026-125350).' The official Changelog for 140 lists 140.0.6074.17 on 10 November 2026, with 'Update Chromium ... to 157.0.8103.39' and a cherry-pick of CVE-2026-125350.
Brave: the official latest-releases page lists Desktop v1.99.56 (10 November 2026) as 'Upgraded Chromium to 157.0.8103.50'. That page does not name CVE-2026-125350.
Microsoft Edge: Microsoft's official security release notes, in an entry dated 9 November 2026, say: 'Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.' That page does not name a desktop Edge build as the fix for CVE-2026-125350. We do not treat unofficial claims of a fixed Edge build as a vendor statement.

Our exposure checker reports every non-Chrome browser, including Edge, Opera and Brave, as UNKNOWN. It does not encode Opera or Brave version numbers. Use the vendor pages above, not the checker, to judge those products.

What to Do in the Next 24 Hours

Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.

Proactive

Update Chrome, then check other browsers

Google: update Chrome to 157.0.8103.50 or 157.0.8103.51 on Windows and Mac, 157.0.8103.50 on Linux, or Extended Stable 156.0.8078.96 or later, and relaunch.
Our advice: inventory every Chrome install, including Extended Stable and Android, and confirm the running process matches the installed fixed build.
Opera (official page): Opera 140 Stable (changelog 140.0.6074.17, 10 November 2026) says it fixed CVE-2026-125350 on Chromium 157.0.8103.39.
Brave and Edge: Brave v1.99.56 upgrades Chromium to 157.0.8103.50 without naming this CVE. Microsoft says it is aware of recent exploits in the wild and is working on a security fix; it has not named a fixed desktop Edge build on its security notes. Our checker reports non-Chrome browsers as UNKNOWN.

Reactive

Hunt and contain

Our advice: Google has published no indicators of compromise. Look for unexpected child processes of Chrome, and of other Chromium browsers you run.
Our advice: look for unexpected script drops and new persistence around the browser.
Our advice: if a host still has a running unfixed Chrome process, relaunch or restart it after the update.
Our advice: if you find signs of misuse, isolate the host, keep EDR telemetry, apply the fixed Chrome build, and rotate the user's credentials.

Proactive: Vendor Steps, Then Ours

Google's 9 November stable update first, then what Opera, Brave and Edge say on their official pages now.

Google 1

Update Chrome to the 9 November stable builds

See Google's Stable Channel Update for Desktop (Monday 9 November 2026). Desktop Stable is 157.0.8103.50 / 157.0.8103.51 on Windows and Mac, and 157.0.8103.50 on Linux. Extended Stable 156.0.8078.96 includes this CVE. Android 157.0.8103.50 has the same security fixes as the corresponding desktop release unless otherwise noted. Relaunch Chrome so the running process matches the installed build.

Other vendors

Read each vendor's own notes

Opera 140 Stable (10 November 2026; changelog 140.0.6074.17) says it updated Chromium to 157.0.8103.39 and fixed CVE-2026-125350. Brave desktop v1.99.56 (10 November 2026) upgraded Chromium to 157.0.8103.50 and does not name this CVE. Microsoft's Edge security release notes (9 November 2026 entry) say Microsoft is aware of recent exploits in the wild and is actively working on releasing a security fix, and do not name a fixed desktop Edge build for this CVE.

Our advice 1

Inventory and use the checker only for Chrome

Inventory Chrome, Edge, Opera, Brave and any other Chromium browser you run. Use the pack checker for Chrome versions and running-vs-installed mismatches. Treat Edge, Opera and Brave rows as UNKNOWN in the checker, and judge them from the vendor pages above.

Free Detection Pack

Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.

Linux and macOS

check-chrome.sh

Read-only offline checker. It judges installed Chrome builds against Google's fixed versions. It reports every non-Chrome browser, including Microsoft Edge, Opera and Brave, as UNKNOWN. It does not encode Opera or Brave version numbers.

bash check-chrome.sh --version 157.0.8103.51 --platform windows

bash check-chrome.sh --version 157.0.8103.50 --running 157.0.8103.39

bash check-chrome.sh --inventory browsers.csv --processes running.csv

Download check-chrome.sh

Windows

Check-Chrome.ps1

The same checks in PowerShell 7, with identical output and exit codes.

pwsh -File Check-Chrome.ps1 -Inventory browsers.csv -Processes running.csv

Download Check-Chrome.ps1 (.zip)

Hunting queries

KQL and Sigma

17 KQL hunts for Microsoft Sentinel and Defender (Q1 to Q1e inventory and versions; Q2 and Q2b running vs installed; Q3 to Q3c child processes; Q4 and Q4b script drops; Q5 and Q5b persistence; Q6 to Q6c other browser inventory). 5 Sigma rules cover suspicious browser children, script drops and persistence, with Kusto conversions included. None of the KQL has been run against a live tenant yet. Google has published no indicators of compromise.

Download KQL (.zip)Download Sigma (.zip)

Verdicts

PATCHEDChrome at 157.0.8103.50 or later in 157.0.8103.x, 156.0.8078.96 or later in 156.0.8078.x, or 158 to 199.
VULNERABLEChrome below the fixed build for its line.
NEEDS RELAUNCHInstalled build is fixed, but a saved running Chrome process is still on an unfixed build.
UNKNOWNEdge or another Chromium browser, Beta, Dev or Canary, Extended Stable on Linux or Android, or a version this pack cannot judge.

Exit codes

Code	Meaning
0	PATCHED
1	VULNERABLE
2	NEEDS RELAUNCH
3	UNKNOWN
5	Usage or read error

For an inventory the exit code is the worst row: VULNERABLE, then NEEDS RELAUNCH, then UNKNOWN, then PATCHED. The checkers report every non-Chrome browser as UNKNOWN. The full pack zip contains 30 files.

What is in the pack

File	What it does
check-chrome.sh	Offline checker for Linux and macOS (bash)
Check-Chrome.ps1	The same checker in PowerShell 7
KQL (17 hunts)	Microsoft Sentinel and Defender hunts Q1 to Q6c
Sigma (5 rules)	Windows, Linux and macOS process and file rules, plus Kusto conversions
tests/	Fixtures and tests
README.md	Verified facts, vendor vs our advice, limits and usage

Download the Full Pack (.zip)README

Reactive: How to Hunt (Our Advice)

Google has published no indicators of compromise. The hunts below are CybaVerse advice. CybaOps can run them across your estate.

Hunt 1

Unexpected browser children

Look for unexpected shells, script interpreters or downloaders spawned by Chrome or other Chromium browsers (pack hunts Q3 to Q3c and the Sigma rules).

Hunt 2

Script drops and persistence

Look for unexpected script file drops and new run-key or other persistence around the browser (Q4, Q5).

Hunt 3

Still-running unfixed processes

A host can have a fixed install and still be running an old process. Confirm running Chrome versions match the fixed build, or relaunch.

If you find signs of compromise (our advice)

Isolate the host and keep EDR telemetry and browser process trees.
Apply the fixed Chrome build and relaunch, and apply each other vendor's own fixed build when that vendor has published one.
Rotate the user's credentials, and review recent downloads and extensions.
Start incident response if the host is used for privileged or admin work.

Chrome CVE-2026-125350 FAQ

Short answers based on Google's 9 November stable-channel update, current Opera, Brave and Microsoft Edge release notes, and CISA KEV, rechecked on 10 November 2026.

What is CVE-2026-125350?

Google's 9 November 2026 Stable Channel Update for Desktop lists a High use-after-free in XML, CVE-2026-125350, reported by anonymous on 6 November 2026. Google writes, verbatim: 'Google is aware that an exploit for CVE-2026-125350 exists in the wild.' The post lists no CVSS score, and we do not invent one. This is High, not a Google Critical rating.

Which Chrome builds are fixed?

Desktop Stable: 157.0.8103.50 and 157.0.8103.51 on Windows and Mac, and 157.0.8103.50 on Linux. Extended Stable 156.0.8078.96 includes this CVE. Android 157.0.8103.50 has the same security fixes as the corresponding desktop release unless otherwise noted. Update and relaunch so the running process matches.

Is it in CISA KEV, and what does the due date mean?

Yes. CISA added CVE-2026-125350 on 10 November 2026, the day after Google's stable post, with a due date of 24 November 2026, ransomware use Unknown, and forensicTriage No. That due date binds US federal agencies only. Our advice, for everyone, is to update now. Do not present the Google post and the KEV addition as the same day.

Has Opera fixed it?

Opera's official Opera 140 Stable post, dated 10 November 2026, says it updated Chromium to 157.0.8103.39 and 'Fixed a security vulnerability (CVE-2026-125350).' The official Changelog for 140 lists 140.0.6074.17 on 10 November 2026, with that Chromium update and a cherry-pick of CVE-2026-125350. Our checker still reports Opera as UNKNOWN.

Has Brave fixed it?

Brave's official latest-releases page lists Desktop v1.99.56 (10 November 2026) as 'Upgraded Chromium to 157.0.8103.50'. That page does not name CVE-2026-125350. Our checker still reports Brave as UNKNOWN.

Has Microsoft Edge fixed it?

Not on the official security release notes we rechecked on 10 November 2026. An entry dated 9 November 2026 says: 'Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.' That page does not name a desktop Edge build as the fix for CVE-2026-125350. We do not use unofficial third-party claims of a fixed Edge build. Our checker reports Edge as UNKNOWN.

Who is this relevant to?

Anyone running Google Chrome, and anyone running other Chromium browsers who needs to follow each vendor's own release notes. MSPs should inventory Chrome and the other browsers their clients use.

Protect Your Browser Estate, and Your Customers'

CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.

Book a CybaOps demo