Chromium: CISA adds CVE-2026-125350 to KEV and urges prioritized remediation

CVE-2026-125350

CISA added CVE-2026-125350, a use-after-free in Chromium's XML component, to KEV and confirmed it is being exploited in the wild. Chrome, Edge, and Opera may be affected; check versions, update per vendor guidance, and note CISA's 2026-11-24 remediation deadline.

At a glance
CISA added CVE-2026-125350 to KEV; the use-after-free in Chromium's XML component is being exploited in the wild.
Google Chrome, Microsoft Edge, and Opera may be affected; specific affected branches have not been provided.
The flaw may allow arbitrary code execution inside the sandbox through a specially crafted webpage.
Prioritize checking and updating according to vendor guidance; CISA's remediation deadline is 2026-11-24.

In this article

CISA added CVE-2026-125350 to KEV and confirmed that the vulnerability is being exploited in the wild. The Google Chrome Stable Channel update for desktop is the source linked in the record.

Overview and technical details

CVE-2026-125350 is a use-after-free in Chromium's XML component. Chromium is an open-source browser platform used by Google Chrome and some other browsers.

Field	Details
Vulnerability ID	CVE-2026-125350
Classification	CWE-416, use-after-free
Exploitation status	CISA KEV; being exploited in the wild
Known ransomware campaign use	Unknown

Affected systems

Browsers that use Chromium may be affected, including Google Chrome, Microsoft Edge, and Opera. The record does not identify affected version branches or fixed versions, so check each browser against its vendor's release guidance.

Mechanism and impact

The use-after-free in the XML component may be exploited remotely through a specially crafted webpage. The confirmed impact is arbitrary code execution inside the sandbox; the record does not specify impact beyond this.

Exploitation status

CISA added CVE-2026-125350 to KEV, and the record confirms that the vulnerability is being exploited in the wild. Its use in a ransomware campaign is listed as Unknown; this does not confirm ransomware use.

System checks

Check the installed Google Chrome version:
```
Mở chrome://settings/help
```
Compare it with Google's release guidance. If use of a fixed version has not been confirmed, update.
Check the installed Microsoft Edge version:
```
Mở edge://settings/help
```
Compare it with Microsoft's update guidance. If use of a fixed version has not been confirmed, update.
Check the installed Opera version:
```
Mở opera://about
```
Compare it with Opera's update guidance. If use of a fixed version has not been confirmed, update.

Remediation and mitigation

Prioritize remediation because the vulnerability is being exploited in the wild. Assess each asset's exposure to the Internet.
Apply mitigations according to vendor guidance and update according to the relevant release guidance. The record does not provide a specific fixed version.
Follow BOD 26-04 and CISA's Forensics Triage Requirements guidance. CISA's remediation deadline is 2026-11-24; this is a deadline under CISA guidance, not a requirement for every reader.
For cloud services, follow the BOD 26-04 guidance applicable to that service. If no mitigation is available, discontinue use of the product.