CVE-2026-125350Google Chromium

Use-After-Free Vulnerability

Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 10 Nov 2026.

Chance of exploitation in 30 daysEPSS

0.96%

0%Higher than 62% of all CVEs

Exploited in the wild: YesPer CISA, listed 10 Nov 2026
Severity: 8.8 of 10High, CVSS
Used in ransomware: Not known
US federal deadline: 24 Nov 2026Agencies must fix it by then

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-125350. Nothing runs until you send it.

About this flaw

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Published: 10 Nov 2026
Weakness: CWE-416

What should I do about this?

Advisories and references