| Severity | HIGH |
| Threat Category | Vulnerability – Use-After-Free (UAF) in XML (actively exploited zero-day) |
| Affected Platforms | Google Chrome (Windows, macOS, Linux, Android) before 157.0.8103.50 on the Stable channel and before 156.0.8078.96 on the Extended Stable channel, and other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) that share the affected component. |
| CVE | CVE-2026-125350 |
| CVSS | 8.8 HIGH (v3.1) |
1. Overview
Google has released an emergency update for the Chrome web browser to fix a high-severity vulnerability that is already being exploited in attacks. CVE-2026-125350 is a use-after-free flaw (CWE-416) in the XML component that Chrome uses to process XSLT. An attacker can exploit it by luring a victim to a specially crafted web page, leading to memory corruption and code execution in the browser. Google has stated that it “is aware that an exploit for CVE-2026-125350 exists in the wild.” This is the eighth exploited Chrome zero-day of 2026.
The issue carries a CVSS version 3.1 score of 8.8 (High). Exploitation requires the victim to visit a malicious or compromised page, but no further interaction, download or prompt. It was reported anonymously on 6 November 2026, fixed by Google on 9 November 2026, and the CVE was published on 10 November 2026. Google has withheld technical details and indicators while most users update.
2. Who is Affected
Anyone using Google Chrome, or another Chromium-based browser such as Microsoft Edge, Brave, Opera or Vivaldi, on an unpatched version is affected. This covers almost every organisation and individual in Bhutan, since Chrome and Edge are the dominant web browsers on government, business and personal devices.
This is an actively exploited zero-day, so the severity is assessed as HIGH and the practical urgency is immediate. The risk basis is as follows:
- Google confirms that an exploit exists in the wild. Attacks do not depend on a future proof-of-concept; they are already happening.
- The United States Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-125350 to its Known Exploited Vulnerabilities catalogue on 10 November 2026, with a remediation due date of 24 November 2026, which reflects the seriousness of the threat.
- Exploitation needs no credentials and no special privileges. The victim only has to open a malicious or compromised web page, which is a very low bar.
- The CVSS score is 8.8 (High). The score is not higher mainly because the victim must visit a page rather than being attacked with no interaction at all.
- Chrome and Chromium browsers are near-universal, so the exposed population is extremely large.
3. How the [Threat/Vulnerability/Attack] Works
- Stage 1 – Root Cause
The flaw is a use-after-free (CWE-416) in the code Chrome uses to process XSLT, a language for transforming XML. A use-after-free occurs when the program continues to use a region of memory after it has been freed, which an attacker can manipulate to corrupt memory. Google has not published the technical specifics of the flaw.
- Stage 2 – Exploitation
An attacker lures or redirects the victim to a web page carrying specially crafted content. When the browser processes that content, the vulnerability is triggered. There is no download to run and no security prompt to click through, which is what makes this class of browser flaw dangerous: simply viewing the wrong page is enough.
- Stage 3 – Impact
Successful exploitation allows code execution within the browser process, with the browser’s privileges. This can lead to theft of saved credentials, session cookies and other browser data, and to the installation of further malware. Chrome runs web content inside a security sandbox, so turning this into full control of the device usually requires chaining it with a second vulnerability. In practice, attackers routinely chain flaws of this kind, so it should be treated as a path to full device compromise.
- Stage 4 – Fix and Disclosure
The vulnerability was reported anonymously on 6 November 2026. Google released fixed versions on 9 November 2026, and the CVE was published on 10 November 2026. It is the eighth Chrome zero-day exploited in attacks during 2026. In keeping with its usual practice, Google is withholding detailed technical information until a majority of users have updated.
4. Indicators to Watch For
- The browser is running an unpatched version. In Chrome, open chrome://version, or go to Settings and then “About Chrome”. Vulnerable if below 157.0.8103.50 (Stable) or below 156.0.8078.96 (Extended Stable).
- A pending “Relaunch to update” prompt in the browser menu, which means an update has downloaded but the browser has not yet restarted to apply it.
- For managed fleets, devices reporting an outdated Chrome version in the browser management console (for example Chrome Browser Cloud Management or your endpoint management tool).
- Unexplained browser crashes or restarts in the days before patching may be a weak signal of exploitation attempts, but are not conclusive.
- Google has not released indicators of compromise for this vulnerability. Therefore, version auditing and patch endorsement are the primary checks.
5. Recommendations
5.1. For organizations and government offices:
- Update Google Chrome to 157.0.8103.50 or later (Stable), or 156.0.8078.96 or later (Extended Stable), across all Windows, macOS and Linux devices, and update Chrome for Android to 157.0.8103.50 or later.
- Ensure browsers are relaunched after updating. Chrome downloads the update in the background, but the fix is not applied until the browser is restarted, which is the step users most often skip.
- Update other Chromium-based browsers, which share the affected component. Microsoft Edge is fixed in 157.0.4341.46 or later (per ThreatDefence); for Brave, Opera, Vivaldi and others, apply the latest version and confirm the fixed build with the browser vendor.
- Push the update across managed fleets using Chrome Browser Cloud Management, Group Policy, or your endpoint management platform, and confirm that every device, including Extended Stable deployments, is on a fixed build.
- Inventory and update embedded or headless Chromium, such as test-automation tools, kiosks, and applications that bundle a Chromium engine. These do not auto-update and are easily overlooked.
- Treat this as a priority in line with the CISA Known Exploited Vulnerabilities due date of 24 November 2026, and update sooner given active exploitation.
- If you suspect a device was compromised before patching, isolate it, reset the affected users’ passwords and browser sessions, and investigate for follow-on malware.
5.2. For individuals (if applicable):
- Open Chrome’s menu, go to Settings and then “About Chrome”, let the browser download the update, and then click “Relaunch” to apply it.
- Update Chrome on your phone through the Google Play Store or Apple App Store, and update any other Chromium-based browser you use (such as Edge, Brave or Opera) the same way.
- Until you have updated and relaunched, be cautious with unexpected links, especially in emails, messages and advertisements.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt
7. Sources and References
- Google Chrome Releases – Stable Channel Update for Desktop (9 November 2026). https://chromereleases.googleblog.com/
- CVE-2026-125350 – CVE Record (10 November 2026).
https://www.cve.org/CVERecord?id=CVE-2026-125350 - Chrome Update Patches Exploited XML Zero-Day, Eighth This Year (SecurityWeek) (10 November 2026).
https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/ - CVE-2026-125350: Chrome XML Zero-Day Exploited in the Wild (SOC Prime) (10 November 2026).
https://socprime.com/blog/cve-2026-125350-chrome-xml-zero-day-exploited-in-the-wild/ - CISA Adds Six Exploited Flaws in Outlook, Chrome, Barracuda, Cisco and Openwave to KEV Catalog (SecurityOnline) (10 November 2026).
https://securityonline.info/cisa-kev-six-vulnerabilities-november-2026/ - Google Chrome CVE-2026-125350 Zero-Day: Patching and Hunting (ThreatDefence) (10 November 2026).
https://threatdefence.com/article/google-chrome-cve-2026-125350-zero-day-patching-hunting