Description
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Chrome | 157.0.8103.50 – < 157.0.8103.50 | 157.0.8103.50 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | chromium | No fix yet | — |
| Debian 13 | chromium | No fix yet | — |
| Debian 12 | chromium | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | chromium | 157.0.8103.50-1.1 | openSUSE-SU-2026:12509-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libxslt | 1.1.43-r4 | — |
| Alpine v3.23 | libxslt | 1.1.43-r4 | — |
| Alpine v3.22 | libxslt | 1.1.43-r4 | — |
| Alpine v3.21 | libxslt | 1.1.42-r3 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libxslt | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | chromium | 157.0.8103.50-r1 | — |
| Wolfi rolling | libxslt +3 | 1.1.45-r6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 4 repositories
-
Frostmoon39206/CVE-2026-125350-PoC ★ 4 · Nov 10, 2026
Technical analysis and skeleton PoC for CVE-2026-125350 (Chrome XML UAF)
-
al4n4n/CVE-2026-125350 ★ 0 · Nov 13, 2026
CVE-2026-125350: Google Chrome libxslt use after free in the direct pattern match cache. Pinned lab, renderer crash PoC with raw evidence, live captures, tested Suricata and YARA rules.
-
TJT001/CVE-2026-125350-PoC ★ 0 · Nov 11, 2026
Google Chrome XSLT pattern-cache Use-After-Free (CVE-2026-125350) crash PoC — affected < 157.0.8103.50
-
ashrafzaryouh/CVE-2026-125350 ★ 0 · Nov 10, 2026
CVE-2026-125350
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- openSUSE-SU-2026:12509-1 chromedriver-157.0.8103.50-1.1 on GA media SUSE / openSUSE Security Updates · Nov 11, 2026
- WID-SEC-2026-4417 Google Chrome / Microsoft Edge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026