External risk intelligence

Google Chrome XML Use After Free Code Execution

CVE advisoryKnown Exploit

CVE-2026-125350

This vulnerability exists within a web browser client. While the software is used to access the public internet, the attack surface requires a user to navigate to a crafted site, meaning it is not a public-facing service, gateway, or appliance that is exposed to the internet by design or typical deployment.

Use After Free

Google Chrome

before 157.0.8103.50

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A recently identified vulnerability in Google Chrome's XML processing could allow attackers to execute arbitrary code within the browser's sandbox. This type of flaw, known as a "use-after-free" issue, is critical because it can be triggered by simply visiting a malicious webpage, potentially impacting how users interact with online content and services. The main concern is confirming if our environment is exposed and if affected software is in use.

Flaw allows code execution from malicious websites.
Affects widely used web browsing technology.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker can trick a user into visiting a malicious webpage. This page exploits a flaw in how the browser handles XML data, leading to a use-after-free condition. Successful exploitation allows the attacker to execute their own code within the confines of the browser's sandbox.

Requires user to visit a malicious page.
Triggered by a crafted HTML page.
Remote code execution within sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox when a user visits a specially crafted HTML page. While the exact impact of sandbox escape is not confirmed, successful exploitation could lead to unauthorized actions on the user's system.

Arbitrary code execution in sandbox.
Via crafted HTML page.
Unauthorized system actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in Google Chrome's XML processing, impacting remote code execution within the sandbox. Action is required by teams responsible for managing user-facing applications and endpoint security to identify and secure affected systems. The immediate first step involves inventorying Chrome deployments, assessing exposure, and confirming business criticality for affected users to prioritize remediation efforts.

Application and endpoint security teams own this.
Verify user exposure and business criticality.
Plan and coordinate client updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome in the context of this advisory?

Google Chrome is a widely used web browser that serves as an interface for accessing web-based content. The software relies on the Chromium engine to render HTML, XML, and other web languages. Because it is a foundational tool for navigating the internet, it is frequently updated to address security weaknesses discovered in its complex data processing components.

How does a use-after-free vulnerability work in CVE-2026-125350?

This flaw, classified as CWE-416, happens when the browser continues to reference a block of memory after it has been freed. If a program tries to use that memory again, an attacker can manipulate the data to execute arbitrary code. In this specific case, the weakness exists within the XML processing module of the browser.

What triggers this vulnerability?

An attacker must trick a user into navigating to a malicious website containing crafted HTML or XML content. Simply having the browser installed does not trigger the vulnerability; it requires active interaction with a malicious page. Consequently, static files or internal pages that do not process untrusted XML data are not typical trigger points for this bug.

How does Halo Surface Signal categorize this threat?

Halo Surface Signal labels this as unlikely to be a public-facing service vulnerability. Because the flaw exists within a client-side application, it does not function like an internet-exposed server or appliance. While your systems use Chrome to access the internet, the software itself is not a gateway open to direct remote connection attempts.

What are the first steps to address CVE-2026-125350?

You should begin by creating an inventory of all systems currently running versions of Chrome older than 157.0.8103.50. Once identified, prioritize these endpoints for updates to the latest stable release. Coordinate with your endpoint security teams to confirm these updates are deployed, as this remains the primary method to mitigate the underlying XML processing defect.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.