# Google Chrome XML Use-After-Free Zero-Day Exploited in the Wild (CVE-2026-125350)

> Google fixed CVE-2026-125350, a high-severity use-after-free in Chrome's XML component, and stated it is aware an exploit exists in the wild. The same update patches eight other Chrome flaws (V8, GPU, FileSystem, Compositing, WebGL, XML). Attribution and targeting have not been disclosed.

- **Published:** 2026-11-10T04:33:13Z
- **Last reviewed:** 2026-11-11T12:40:56.937Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5611
- **ID:** TL-2026-5611
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (1 shown free below)
- **CVEs:** CVE-2026-125350, CVE-2026-125346, CVE-2026-125344, CVE-2026-125348, CVE-2026-125347, CVE-2026-125343, CVE-2026-125345, CVE-2026-125342, CVE-2026-125349

## Description

Google released Chrome Stable updates addressing nine vulnerabilities, one of which, CVE-2026-125350, is a use-after-free in the XML component reported by an anonymous researcher on 2026-11-06. Google's advisory language, as quoted by Cyber Security News, is that Google 'is aware that an exploit for this flaw exists in the wild'. Google has not said who is exploiting it or how many users were targeted, and no attribution, victimology, or indicators of compromise have been published.

Fixed builds are Chrome Stable 157.0.8103.50/.51 (Windows and Mac), 157.0.8103.50 (Linux), and Extended Stable 156.0.8078.96. The Chrome Stable Desktop post is dated 2026-11-09 on the Chrome Releases blog. The primary news source reports the release as containing seven High and two Medium severity fixes and notes that Chrome 157 had shipped days earlier with 213 security fixes, seven of them Critical.

The same release fixes: CVE-2026-125346 (XML use-after-free, reported 2026-10-12 by Arni Hardarson of Neonix Security), CVE-2026-125344 (V8 type confusion), CVE-2026-125348 (GPU out-of-bounds write), CVE-2026-125347 (FileSystem incorrect authorization), CVE-2026-125343 (Compositing buffer overflow), CVE-2026-125345 (WebGL uninitialized resource), and CVE-2026-125342 and CVE-2026-125349 (GPU uninitialized resource, Medium; the former reported by Vo Duc Thang). The exploitation vector for CVE-2026-125350 is not described in the available sources. Use-after-free bugs in a renderer-side component such as XML are typically triggered by attacker-controlled web content, so drive-by delivery is the expected, but unconfirmed, vector, and a renderer bug of this type would usually need a separate sandbox escape for full system compromise; no such chain is documented here.

Sourcing caveat: only one secondary source (Cyber Security News) was retrievable with the details. The NVD API returned no record for CVE-2026-125350 at research time, the CISA KEV catalog could not be confirmed to list it, and the Chrome Releases post body could not be retrieved. CVSS score and vector are therefore not stated. Treat details as provisional until NVD, the Chrome Releases post, and the Chromium issue tracker are confirmed.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1566.002 Phishing: Spearphishing Link
- T1189 Drive-by Compromise
- T1211 Exploitation for Defense Evasion
- T1068 Exploitation for Privilege Escalation
- T1059.007 Command and Scripting Interpreter: JavaScript

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Chrome Renderer Spawning Shell or LOLBin — Post-Exploitation After Chrome XML UAF (CVE-2026-125350)** (`TL-2026-5611-SPL-002`)

Detects a chrome.exe --type=renderer process creating cmd, PowerShell, script hosts, mshta, rundll32, regsvr32, certutil, bitsadmin, curl, wmic or msiexec. Chrome's sandbox normally prevents renderers from creating processes, so a hit means renderer code execution (such as a CVE-2026-125350 use-after-free exploit) was chained with a sandbox escape, or the sandbox was disabled. Very high fidelity; research recommends EDR browser child-process anomaly detection for exactly this case.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059, T1068
- **Data sources:** sysmon (EventCode 1), DeviceProcessEvents, windows process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\chrome.exe" ParentCommandLine="*--type=renderer*" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\certutil.exe","*\\bitsadmin.exe","*\\curl.exe","*\\wmic.exe","*\\msiexec.exe")
| stats count earliest(_time) AS first_seen values(CommandLine) AS command_lines values(User) AS users values(FileVersion) AS child_version BY host ParentImage Image
| eval first_seen=strftime(first_seen,"%F %T"), note="Renderer spawned child - possible CVE-2026-125350 exploit plus sandbox escape"
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "chrome.exe" and InitiatingProcessCommandLine has "--type=renderer"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wmic.exe", "msiexec.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessAccountName, SHA256
```

### Sigma

```yaml
title: Chrome Renderer Process Spawning Shell or LOLBin
id: 3e9b61d8-7a24-4f0c-a1d5-c58b0e2f7a49
status: experimental
description: A Chrome renderer (--type=renderer) creating a command interpreter or living-off-the-land binary. Indicates renderer exploitation chained with a sandbox escape, as would follow exploitation of the Chrome XML use-after-free CVE-2026-125350.
references:
  - https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
  - https://cybersecuritynews.com/google-chrome-0-day-exploited/
author: Threadlinqs Team
date: 2026-11-10
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.125350
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
    ParentCommandLine|contains: '--type=renderer'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wmic.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Chrome run with --no-sandbox by developers or test automation
level: critical
```

**Known false positives:**

- Chrome launched with --no-sandbox by developers, Selenium or Puppeteer test automation that shells out
- Kiosk or signage software wrapping Chrome and launching helpers

**Tuning notes:** Exclude known automation hosts by host or ParentCommandLine containing --no-sandbox only after review (an attacker can also disable the sandbox). Treat any hit on a standard user workstation as an incident: isolate, capture memory and the browser history around the event. Chrome's main browser process legitimately launches helpers, which is why the parent is restricted to --type=renderer.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable Chrome Build (pre-157.0.8103.50 / pre-156.0.8078.96) Running Renderers — CVE-2026-125350 Exposure (locked: unlock with TL Creds)
- Unexpected Child Process of Sandboxed Chrome Process — Sandbox Escape Indicator (CVE-2026-125350) (locked: unlock with TL Creds)
- Outbound Public Connections from Chrome-Spawned Non-Browser Process — Exploit Follow-On (CVE-2026-125350) (locked: unlock with TL Creds)
- Chrome Launched with URL by Mail Client or Office App — Spearphishing Link Delivery for CVE-2026-125350 (locked: unlock with TL Creds)
- Chrome-Spawned Download Cradle or Encoded PowerShell — Payload Staging After Browser Exploit (CVE-2026-125350) (locked: unlock with TL Creds)
- DNS or Network Access to Community-Reported Fake Google Sign-In Domain my-settings-google.com (Phishing Delivery Context) (locked: unlock with TL Creds)
- Chrome Browser-Module Crash on Build Vulnerable to CVE-2026-125350 (XML UAF) — Exploitation Phase (locked: unlock with TL Creds)
- Beacon-Like Outbound Connections from Process Spawned by Sandboxed Chrome (CVE-2026-125350 Follow-On C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 29)

Defanged, TLP:CLEAR.

- File hash: `61cab3f77203671e09402e68738aa217632aed8d`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Google Chrome 0-Day Vulnerability in the Wild to Execute Malicious Code Remotely](https://cybersecuritynews.com/google-chrome-0-day-exploited/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html)
- [Chromium Security](https://www.chromium.org/Home/chromium-security)
- [Chromium issue tracker: M157 security fixes](https://issues.chromium.org/issues?q=customfield1223088:1-M157)
- [Chromium source log 157.0.8103.39..157.0.8103.50](https://chromium.googlesource.com/chromium/src/+log/157.0.8103.39..157.0.8103.50?pretty=fuller&n=10000)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD CVE API for CVE-2026-125350](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-125350)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5611