Chrome XML Zero-Day (CVE-2026-125350) Active Exploitation

Active Exploitation | Zero-Day | Google Chrome | XML Use-After-Free | CVE-2026-125350

Source Material: Chrome Stable Release; Chrome Extended Stable Release; Chrome Update Help; CUHK ITSC Alert; CERT-In Advisory; CISA KEV Catalog | Technology: Google Chrome, Chromium-based browsers, XML processing | Targeting: Undisclosed / potentially broad

Executive Summary

Google has released a Chrome security update addressing nine vulnerabilities, including CVE-2026-125350, a High-severity use-after-free flaw in the browser’s XML component. Google confirms that an exploit for this vulnerability exists in the wild. Technical details remain restricted while the update rolls out.

Chrome Stable versions earlier than 157.0.8103.50 are exposed to the security issues addressed by this release. Fixed desktop builds are 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux. Google also released 157.0.8103.50 for Android and 156.0.8078.96 for the Extended Stable channel on Windows and macOS.

Available reporting does not identify the attacker, targets, delivery method, exploit chain, malware, or indicators of compromise for the in the wild exploitation. A CVSS score has not been published. The confirmed in-the-wild exploit raises the operational priority for applying the updates.

Organizations should update Chrome immediately, restart the browser to activate the fix, and verify the running version across managed endpoints. Security teams should also track vendor updates for other Chromium-based browsers and embedded Chromium runtimes rather than assuming the Chrome update protects them.

Threat Overview and Strategic Impact

CVE-2026-125350 is a use-after-free vulnerability in Chrome’s XML component. A use-after-free occurs when software continues to reference memory after it has been released, creating an opportunity for memory corruption. Depending on exploit conditions, an attacker may be able to crash a renderer or gain code execution within the browser process. Google has not disclosed the technical trigger, prerequisites, or whether the observed exploit was chained with a sandbox escape.

Google rates the issue High and states that an exploit exists in the wild. The vulnerability was reported anonymously shortly before the security update. No threat actor, victim profile, geography, delivery mechanism, exploit sample, malware payload, or campaign infrastructure has been publicly identified. CISA had not added CVE-2026-125350 to the Known Exploited Vulnerabilities catalog at publication.

The exposure is broad because Chrome is widely deployed and browsers routinely process untrusted internet content. A successful compromise may expose browser-accessible data or serve as the first stage of a larger intrusion. Full host compromise may require additional exploitation, and the public evidence does not establish that such a chain was used. Fixed builds are Chrome Stable 157.0.8103.50/.51 for Windows and macOS, 157.0.8103.50 for Linux and Android, and Extended Stable 156.0.8078.96 for Windows and macOS.

Security Hardening and Recommendations

Deploy Chrome Stable 157.0.8103.50/.51 or later on Windows and macOS and 157.0.8103.50 or later on Linux. Force or prompt a full browser relaunch and verify the running version, not only package deployment status.
For Windows and macOS devices on Extended Stable, deploy 156.0.8078.96 or later. Update Chrome for Android to 157.0.8103.50 or later as it becomes available through Google Play.
Use enterprise browser-management controls to accelerate updates, enforce relaunch deadlines, and identify devices that remain below the fixed build. Prioritize administrators, developers, executives, and other users with access to sensitive applications.
Inventory other Chromium-based browsers and embedded Chromium runtimes. Apply vendor updates that explicitly incorporate the upstream fix; do not assume updating Chrome also patches Edge, Brave, Electron, CEF, or other products. Where immediate patching is impossible, reduce exposure with browser isolation, URL filtering, and restrictions on untrusted web content.

Detection Strategy

Monitor endpoint telemetry for unusual child processes spawned by Chrome, including command shells, script interpreters, system utilities, or unsigned binaries. Correlate these events with browser crashes, navigation to newly observed or low-reputation domains, executable or script writes to user-writable directories, memory-injection alerts, persistence changes, and unexpected outbound connections. These behaviors indicate possible post-exploitation, but none are unique to CVE-2026-125350 and require validation.

How Deepwatch Protects Our Customers

Deepwatch experts are continuously monitoring for suspicious delivery and post-exploitation behaviors through endpoint and network telemetry. Relevant detection coverage includes malicious-link delivery, traffic to known phishing infrastructure, unexpected browser child processes, suspicious file creation, and follow-on command execution. Customers should use NEXA Detection Advisor to review which relevant detections are enabled and pair monitoring with urgent browser-version compliance checks.

Relevant Detections

Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.

Threat Hunting Leads

Inventory Chrome installations below the fixed versions and identify devices where the browser has not restarted since the update was deployed.
Hunt for unusual child processes from chrome.exe or Google Chrome, especially shells, script interpreters, system utilities, or unsigned binaries.
Correlate repeated Chrome renderer crashes with visits to newly registered, low-reputation, or previously unseen domains and subsequent endpoint alerts.
Review executable, script, or library files written by Chrome into user-writable directories, followed by persistence, credential access, or outbound connections.

Technical Artifacts

Please visit the Guardian Platform to access available technical artifacts for this report.

Threat Object Mapping

Intrusion Set:

Unknown

Attack Pattern (MITRE ATT&CK/MITRE ATLAS):

Tactic	Technique	Technique ID	Associated Threat Activity
Initial Access	Drive-by Compromise	T1189	Plausible browser-exploit delivery route; observed mechanism undisclosed.
Execution	Exploitation for Client Execution	T1203	Memory-safety exploitation in Chrome XML; exploit chain undisclosed.
Execution	User Execution: Malicious Link	T1204.002	Possible malicious-link lure; not confirmed in observed attacks.