Key Takeaways
- Who should care: Every team running Chrome, Edge or Opera on company endpoints.
- What could go wrong: One crafted web page runs attacker code inside the browser.
- Do this: Update to Chrome 157.0.8103.50 or later and relaunch today.
- Worth remembering: A downloaded patch does nothing until the browser restarts.
Eight. That’s how many Chrome zero-day attacks attackers have used this year, and the newest one, CVE-2026-125350, just landed on CISA’s exploited list. No click on a download. No macro. Just a booby-trapped web page. Patch, then relaunch.
What Happened?
An anonymous researcher reported a use-after-free bug in Chrome’s XML component on November 6. Three days later, Google shipped a fix and confirmed an exploit already exists in the wild.
Tracked as CVE-2026-125350, the flaw sits in libxslt, the XSLT library Chrome bundles, where a nested evaluation can free cached memory that an earlier operation still points to. It scores 8.8 on CVSS.
CISA added it to the KEV catalog on November 10, and federal agencies must patch by November 24. Google hasn’t said who is attacking or who is being hit.
What’s the Impact?
CVE-2026-125350 lets a remote attacker use a crafted HTML page to run code inside Chrome’s sandbox. That is usually stage one of a chain, with a sandbox escape finishing the job.
Edge is affected, Opera is named in the KEV entry, and Electron apps stay exposed until their makers ship new builds.
How to Protect Against CVE-2026-125350
- Update Chrome to 157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux and Android, or 156.0.8078.96 on Extended Stable
- Force a relaunch with the RelaunchNotification policy so the fix actually loads
- Move Early Stable users off 158.0.8127.18/.19, which are still vulnerable, to 158.0.8127.30
- Can’t patch everything today? Set the XSLTEnabled policy to false as a stopgap
- Update Edge, Opera, Brave, and Vivaldi as each vendor ships its fix
Indicators of Compromise
Google has published no hashes, domains, or IPs for CVE-2026-125350, and the bug details stay locked until most users update. So the absence of a hit proves nothing.
Hunt behavior instead: Chrome or Edge spawning cmd.exe, powershell.exe, or mshta.exe, bursts of crash dumps on one host, odd .xsl fetches in proxy logs, and the browser writing executables outside the Downloads folder. The full list is in the visual below.
Eight Zero Days. Zero Room for Spreadsheet Patching.
Chrome has been hit about once every five or six weeks this year, and each round starts the same scramble: who’s patched, who hasn’t relaunched, which Chromium browser got missed. Secure.com’s AI teammates do that legwork inside the rules your team sets, so your analysts don’t have to.
- Flags every endpoint still on a vulnerable Chrome or Edge build, with KEV status and the due date attached
- Pushes KEV-listed browser flaws to the top of the fix-first queue the moment CISA lists them
- Routes the patch or the XSLTEnabled stopgap through the approvals your team already uses
- Rechecks versions after rollout, so “patched” comes with proof
- Takes the Monday morning KEV check off your team’s plate for good
The Bottom Line
CVE-2026-125350 went from private report to confirmed attacks in under a week. The patch is out. The real risk is the browser nobody restarted and the Chromium fork nobody remembered. Close both before the November 24 deadline; it’s not on it.
