Event Monitor Cyber
EM-20261110-R5PF VulnerabilityHigh severity

Google Chromium Use-After-Free Vulnerability

CVE-2026-125350 · Google Chromium

Share

5 hours from first report to confirmed exploitation.

Status
Confirmed

Since : exploitation in the wild reported.

First Signal
Nov 10 00:00 UTCC13 CERT-FR (ANSSI)
Page Born
Nov 10 06:52 UTCsecond source joined
Last Signal
Nov 10 18:17 UTC8 hours before snapshot
Sources
72 official · 5 research, news or crowd
Open For
20 hoursso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The ID never changes, and earlier addresses keep working. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Nov 10 18:17 UTC
    C6 NVD published
  2. Scored: reached
    Nov 10 18:17 UTC
    CVSS 8.8
  3. Exploited: reached
    Nov 10 05:26 UTC
    C1 CISA KEV, fix by Nov 24
  4. Advisories: reached
    Nov 10 00:00 UTC
    1 government and CERT sources
  5. Vendor Response: not yet
    Not yet
    None in sources yet
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline Nov 24, then 14 quiet days

Timeline

18:00Nov 1006:0012:0018:00BornConfirmedC13 CERT-FR (ANSSI)C171 GBHackersC130 The Hacker NewsC170 CyberInsiderC172 Security AffairsC1 CISA Known Exploited VulnerabilitC6 NVD CVE API 2.0

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. CVE-2026-125350 (CVSS 8.8) (opens source in a new tab) Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) High severityDatabaseC6 NVD CVE API 2.0
  2. CVE-2026-125350 added to KEV: Google Chromium Use-After-Free Vulnerability (opens source in a new tab) Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  3. Google fixes the eighth actively exploited Chrome zero-day of 2026 (opens source in a new tab) Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which… Med severityResearch & NewsC172 Security Affairs
  4. Google fixes Chrome XML zero-day flaw exploited in attacks (opens source in a new tab) Google released a Chrome security update that addresses nine vulnerabilities, including a high-severity XML flaw exploited in the wild. The security update brings the Stable channel to version 157.0.8103.50/.51 for… Med severityResearch & NewsC170 CyberInsider
  5. Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 (opens source in a new tab) Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350… Med severityResearch & NewsC130 The Hacker News
  6. Google Chrome Zero-Day Vulnerability Exploited in the Wild (opens source in a new tab) Google released a Chrome security update that fixes nine vulnerabilities, including a high-severity XML flaw being exploited in the wild. Tracked as CVE-2026-125350, the zero-day makes this release a priority for… Med severityResearch & NewsC171 GBHackers
  7. Multiples vulnérabilités dans Google Chrome (10 novembre 2026) (opens source in a new tab) De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur. Google indique que la vulnérabilité CVE-2026-125350… Med severityGovernmentC13 CERT-FR (ANSSI)