In short: CVE-2026-125350 is a flaw in Chromium, the engine inside Google Chrome, Microsoft Edge, Opera, Brave, Vivaldi and other browsers. CVE stands for Common Vulnerabilities and Exposures, the public numbering of security flaws. Update your browser and relaunch it today.

CVE-2026-125350 at a glance

What

A flaw in Chromium, the engine inside Chrome, Edge and other browsers.

Who

Computers running Chrome, Edge or another Chromium browser.

Fix

Update the browser, then click Relaunch.

Source: Google Chrome Releases; Cybersecurity and Infrastructure Security Agency (CISA).

What happened

On November 9, 2026, Google released a Chrome update that fixes CVE-2026-125350, a use-after-free flaw in the Extensible Markup Language (XML) component of Chromium. This is a memory handling error that an attacker can take advantage of. Google said it knows an exploit exists in the wild.

On November 10, 2026, CISA, the United States cyber defence agency, added the flaw to its Known Exploited Vulnerabilities catalog. CISA has not said who is using it or whether ransomware groups use it. SecurityWeek, a security news publication, counts it as the eighth Chrome zero-day exploited in 2026. A zero-day is a flaw that attackers used before a fix was available.

What an attacker gains

A specially crafted web page could let a remote attacker run code inside the browser's sandbox. The sandbox is a protective layer that keeps web page code separate from the rest of the computer. Nothing public shows a sandbox escape or a full computer takeover from this flaw alone.

Who is affected

  • Google Chrome on Windows, Mac and Linux older than the fixed versions below.
  • Microsoft Edge, Opera, Brave, Vivaldi and other Chromium browsers. Each one needs the update from its own vendor.
ChromeFixed version
Windows and Mac157.0.8103.50 or 157.0.8103.51
Linux157.0.8103.50
Extended Stable156.0.8078.96

What to do now

  1. Update Chrome. Open the Chrome menu, then Help, then About Google Chrome. Chrome checks for the update and installs it.
  2. Click Relaunch. The update is not active until the browser restarts. Do not postpone the relaunch.
  3. Check the version number. On the same page, confirm that it is at least the fixed version listed above.
  4. Update Microsoft Edge the same way. Open Settings, then About Microsoft Edge, and restart the browser after it updates.
  5. On managed computers, the update arrives through patch management. Ask your information technology (IT) team to confirm that every browser has been updated and restarted.
Hexafusion clients: managed computers receive browser updates through our patch management. A restart of the browser is still needed. For questions, call 604-332-1500.

See also our security protections checklist.

Common questions

What is CVE-2026-125350?
A use-after-free flaw in the XML component of Chromium, the engine inside Chrome, Edge, Opera, Brave, Vivaldi and other browsers. Google released the fix on November 9, 2026.
How do I fix it in Chrome?
Open the Chrome menu, then Help, then About Google Chrome. Let Chrome update, then click Relaunch.
Does it affect Microsoft Edge and other browsers?
Yes. They use the same engine, and each one needs the update from its own vendor. In Edge, open Settings, then About Microsoft Edge.
Can this flaw take over a computer?
A specially crafted web page could let a remote attacker run code inside the browser's sandbox. Nothing public shows a sandbox escape or a full computer takeover from this flaw alone.

Sources

Not sure whether every browser is updated?

We can check which browser versions are installed on your computers and tell you what needs updating.

Talk to us