Skip to navigation

Threat reportVulnerabilityTL-2026-5611

Google Chrome XML Use-After-Free Zero-Day Exploited in the Wild (CVE-2026-125350)

highACTIVE

Google fixed CVE-2026-125350, a high-severity use-after-free in Chrome's XML component, and stated it is aware an exploit exists in the wild. The same update patches eight other Chrome flaws (V8, GPU, FileSystem, Compositing, WebGL, XML). Attribution and targeting have not been disclosed.

Key facts

IdentifiersTL-2026-5611, CVE-2026-125350, CVE-2026-125346, CVE-2026-125344, CVE-2026-125348, CVE-2026-125347, CVE-2026-125343, CVE-2026-125345, CVE-2026-125342, CVE-2026-125349
SeverityHIGH
CVSS8.8
Affected productsGoogle Chrome (Stable); Google Chrome (Extended Stable)
Weaknesses (CWE)CWE-416, CWE-843, CWE-787, CWE-863, CWE-908, CWE-415
MITRE ATT&CK techniquesT1059.007 Command and Scripting Interpreter: JavaScript, T1068 Exploitation for Privilege Escalation, T1189 Drive-by Compromise, T1203 Exploitation for Client Execution, T1204.001 User Execution: Malicious Link, T1211 Exploitation for Defense Evasion, T1566.002 Phishing: Spearphishing Link
MotivationUNKNOWN
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5611 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Chrome Renderer Spawning Shell or LOLBin — Post-Exploitation After Chrome XML UAF (CVE-2026-125350)

Detects a chrome.exe --type=renderer process creating cmd, PowerShell, script hosts, mshta, rundll32, regsvr32, certutil, bitsadmin, curl, wmic or msiexec. Chrome's sandbox normally prevents renderers from creating processes, so a hit means renderer code execution (such as a CVE-2026-125350 use-after-free exploit) was chained with a sandbox escape, or the sandbox was disabled. Very high fidelity; research recommends EDR browser child-process anomaly detection for exactly this case.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1203, T1059, T1068
  • Data sources: sysmon (EventCode 1), DeviceProcessEvents, windows process_creation
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\chrome.exe" ParentCommandLine="*--type=renderer*" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\curl.exe","*\\wmic.exe","*\\msiexec.exe")
| stats count earliest(_time) AS first_seen values(CommandLine) AS command_lines values(User) AS users values(FileVersion) AS child_version BY host ParentImage Image
| eval first_seen=strftime(first_seen,"%F %T"), note="Renderer spawned child - possible CVE-2026-125350 exploit plus sandbox escape"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe" and InitiatingProcessCommandLine has "--type=renderer"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wmic.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessAccountName, SHA256

Sigma

title: Chrome Renderer Process Spawning Shell or LOLBin
id: 3e9b61d8-7a24-4f0c-a1d5-c58b0e2f7a49
status: experimental
description: A Chrome renderer (--type=renderer) creating a command interpreter or living-off-the-land binary. Indicates renderer exploitation chained with a sandbox escape, as would follow exploitation of the Chrome XML use-after-free CVE-2026-125350.
references:
  - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
  - https://cybersecuritynews.com/google-chrome-0-day-exploited/
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.125350
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
    ParentCommandLine|contains: '--type=renderer'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Chrome run with --no-sandbox by developers or test automation
level: critical

Known false positives:

  • Chrome launched with --no-sandbox by developers, Selenium or Puppeteer test automation that shells out
  • Kiosk or signage software wrapping Chrome and launching helpers

Tuning notes: Exclude known automation hosts by host or ParentCommandLine containing --no-sandbox only after review (an attacker can also disable the sandbox). Treat any hit on a standard user workstation as an incident: isolate, capture memory and the browser history around the event. Chrome's main browser process legitimately launches helpers, which is why the parent is restricted to --type=renderer.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Vulnerable Chrome Build (pre-157.0.8103.50 / pre-156.0.8078.96) Running Renderers — CVE-2026-125350 Exposure · unlock with TL Creds
  • Unexpected Child Process of Sandboxed Chrome Process — Sandbox Escape Indicator (CVE-2026-125350) · unlock with TL Creds
  • Outbound Public Connections from Chrome-Spawned Non-Browser Process — Exploit Follow-On (CVE-2026-125350) · unlock with TL Creds
  • Chrome Launched with URL by Mail Client or Office App — Spearphishing Link Delivery for CVE-2026-125350 · unlock with TL Creds
  • Chrome-Spawned Download Cradle or Encoded PowerShell — Payload Staging After Browser Exploit (CVE-2026-125350) · unlock with TL Creds
  • DNS or Network Access to Community-Reported Fake Google Sign-In Domain my-settings-google.com (Phishing Delivery Context) · unlock with TL Creds
  • Chrome Browser-Module Crash on Build Vulnerable to CVE-2026-125350 (XML UAF) — Exploitation Phase · unlock with TL Creds
  • Beacon-Like Outbound Connections from Process Spawned by Sandboxed Chrome (CVE-2026-125350 Follow-On C2) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5611.

Sample indicators (1 of 29)

  • File hash: 61cab3f77203671e09402e68738aa217632aed8d

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

29 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Google released Chrome Stable updates addressing nine vulnerabilities, one of which, CVE-2026-125350, is a use-after-free in the XML component reported by an anonymous researcher on 2026-11-06. Google's advisory language, as quoted by Cyber Security News, is that Google 'is aware that an exploit for this flaw exists in the wild'. Google has not said who is exploiting it or how many users were targeted, and no attribution, victimology, or indicators of compromise have been published.

Fixed builds are Chrome Stable 157.0.8103.50/.51 (Windows and Mac), 157.0.8103.50 (Linux), and Extended Stable 156.0.8078.96. The Chrome Stable Desktop post is dated 2026-11-09 on the Chrome Releases blog. The primary news source reports the release as containing seven High and two Medium severity fixes and notes that Chrome 157 had shipped days earlier with 213 security fixes, seven of them Critical.

The same release fixes: CVE-2026-125346 (XML use-after-free, reported 2026-10-12 by Arni Hardarson of Neonix Security), CVE-2026-125344 (V8 type confusion), CVE-2026-125348 (GPU out-of-bounds write), CVE-2026-125347 (FileSystem incorrect authorization), CVE-2026-125343 (Compositing buffer overflow), CVE-2026-125345 (WebGL uninitialized resource), and CVE-2026-125342 and CVE-2026-125349 (GPU uninitialized resource, Medium; the former reported by Vo Duc Thang). The exploitation vector for CVE-2026-125350 is not described in the available sources. Use-after-free bugs in a renderer-side component such as XML are typically triggered by attacker-controlled web content, so drive-by delivery is the expected, but unconfirmed, vector, and a renderer bug of this type would usually need a separate sandbox escape for full system compromise; no such chain is documented here.

Sourcing caveat: only one secondary source (Cyber Security News) was retrievable with the details. The NVD API returned no record for CVE-2026-125350 at research time, the CISA KEV catalog could not be confirmed to list it, and the Chrome Releases post body could not be retrieved. CVSS score and vector are therefore not stated. Treat details as provisional until NVD, the Chrome Releases post, and the Chromium issue tracker are confirmed.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1189 Drive-by Compromise; T1566.002 Phishing: Spearphishing Link

Defense Evasion

T1211 Exploitation for Defense Evasion

Remediation

Patches

  • Chrome Stable 157.0.8103.50/.51 (Windows, Mac)
  • Chrome Stable 157.0.8103.50 (Linux)
  • Chrome Extended Stable 156.0.8078.96

Immediate actions

  • Update Google Chrome to Stable 157.0.8103.50/.51 (Windows/Mac) or 157.0.8103.50 (Linux) and relaunch the browser
  • Update Chrome Extended Stable to 156.0.8078.96
  • Verify fleet-wide Chrome versions via endpoint management and force relaunch to complete patching

Workarounds

  • No vendor workaround published; reduce exposure by restricting browsing of untrusted sites on unpatched systems until updated

Longer-term hardening

  • Enforce automatic browser updates and a maximum update-lag policy
  • Keep Chrome's renderer sandbox and Site Isolation enabled; deploy EDR with browser child-process anomaly detection
  • Update other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as vendors ship the upstream fix

Affected and fixed versions

  • Google — Chrome (Stable)
    Vulnerable versions: Chrome Stable 157.x prior to 157.0.8103.50
    Fixed in: 157.0.8103.50/.51 (Windows, Mac); 157.0.8103.50 (Linux)
  • Google — Chrome (Extended Stable)
    Vulnerable versions: Extended Stable prior to 156.0.8078.96
    Fixed in: 156.0.8078.96

Timeline

Last updated · 4 updates · revalidated 4× · latest source

  • Earliest report date among the nine fixed bugs: CVE-2026-125349 (GPU uninitialized resource) reported to Google.
  • CVE-2026-125345 (WebGL uninitialized resource) reported to Google.
  • CVE-2026-125347 (FileSystem incorrect authorization) and CVE-2026-125343 (Compositing buffer overflow) reported to Google.
  • CVE-2026-125348 (GPU out-of-bounds write) reported to Google.
  • Vo Duc Thang (ugvxb) reports GPU uninitialized resource CVE-2026-125342 (Chromium issue 566384898).
  • CVE-2026-125344 (V8 type confusion) reported to Google.
  • Arni Hardarson (Neonix Security) reports the related XML use-after-free CVE-2026-125346.
  • Chrome 158.0.8127.18/.19 pushed to a small group of Windows Early Stable users; these builds predate the fix.
  • An anonymous researcher reports the XML use-after-free CVE-2026-125350 to Google.
  • Fix committed to Chromium (commit locked-ioc-2) per Ostorlab.
  • Chrome 158.0.8127.30 (Early Stable) tagged with the fix.
  • Google states it is aware an exploit for CVE-2026-125350 exists in the wild; no attribution or targeting details disclosed.
  • Google publishes the Chrome Stable and Extended Stable Desktop updates (157.0.8103.50/.51 and 156.0.8078.96) fixing nine vulnerabilities.
  • CISA adds CVE-2026-125350 to the Known Exploited Vulnerabilities catalog ('Google Chromium Use-After-Free Vulnerability') with a remediation due date of 2026-11-24.
  • NVD publishes CVE-2026-125350 (CWE-416, CVSS 3.1 8.8 High per secondary source; code execution inside the browser sandbox via a crafted HTML page).
  • HKCERT rates the Chrome update 'Extremely High' risk; further outlets report it as the eighth exploited Chrome zero-day of 2026. CVE not yet in NVD or CISA KEV per secondary reporting.
  • Cyber Security News reports the zero-day and the accompanying fixes.
  • Truesec and ThreatDefence publish analyses; upstream libxslt remains unfixed and Microsoft has not mapped the CVE to an Edge build.
  • CISA KEV remediation deadline for federal agencies under BOD 26-04.

Update history

Sources cited

Other reports on CVE-2026-125350

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats