WhatCyber / CISA KEV catalog / CVE-2026-125350
CVE-2026-125350: Google Chromium
Google Chromium Use-After-Free Vulnerability
Actively exploited (CISA KEV) HIGH severity
Description
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Key facts
- CVSS v3
- 8.8 (HIGH)
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Published
- 2026-11-10
- Last modified
- 2026-11-11
- NVD status
- Analyzed
- Added to CISA KEV
- 2026-11-10
- CISA due date
- 2026-11-24
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-125350
Weaknesses (CWE)
- CWE-416
Affected products
- google chrome
References
- https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
- https://issues.chromium.org/issues/582442907
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350