CVE-2026-125350: Chrome XML Use-After-Free Exploited

How to Detect CVE-2026-125350

Detection should combine version inventory, update telemetry, process-state validation, and endpoint threat hunting. The most reliable exposure check is to identify Chrome installations below the applicable fixed build and then confirm that running browser processes report the fixed version after deployment. Reconcile asset-management data with endpoint telemetry because stale records can miss browsers installed per user or in nonstandard paths.

Security teams should also review browser-originated child processes, suspicious downloads, unusual browser crashes, and visits to newly registered or low-reputation domains. These signals are not specific to CVE-2026-125350 and cannot prove exploitation by themselves. They can prioritize investigation of systems that were vulnerable during the exploitation window.

Linux Version Checks

A Linux inventory check can identify installed Chrome versions and compare them with the fixed release:

google-chrome --version 2>/dev/null || google-chrome-stable --version 2>/dev/null
chromium --version 2>/dev/null

Windows Version Checks

For Windows environments, a PowerShell inventory query can inspect common installation locations:

$paths = @(
  "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
  "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
  "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)

$paths | Where-Object { Test-Path $_ } | ForEach-Object {
  $v = (Get-Item $_).VersionInfo.ProductVersion
  [PSCustomObject]@{ Path = $_; Version = $v }
}

Suspicious Child-Process Detection

Endpoint telemetry should alert on Chrome spawning unexpected interpreters, scripting engines, or shell processes. A generic process-creation query can be adapted to the organization’s EDR or SIEM:

parent_process_name IN ("chrome.exe", "google-chrome", "chromium")
AND child_process_name IN ("powershell.exe", "pwsh.exe", "cmd.exe",
                           "wscript.exe", "cscript.exe", "mshta.exe",
                           "rundll32.exe", "regsvr32.exe")

This is a behavioral detection, not a CVE-specific signature. Investigate the command line, initiating URL where available, user context, download history, and timing relative to Chrome’s vulnerable-version window. No network signature for this vulnerability is established in the supplied sources, so teams should not claim that generic HTTP inspection can reliably identify exploitation.

Mitigation and Patching

Update Chrome immediately to the applicable fixed version. The minimum fixed versions identified in the available release information are Chrome 157.0.8103.50 for Linux, Chrome 157.0.8103.50 or 157.0.8103.51 for Windows and macOS, and Chrome Extended Stable 156.0.8078.96 where that channel applies. Organizations should prefer the latest vendor-supported release rather than pinning indefinitely to the minimum security version.

After deployment, restart Chrome and verify the running browser build. Downloading or staging an update does not guarantee that active browser processes have stopped using vulnerable code. Prioritize internet-connected workstations, privileged administrator endpoints, high-value users, unmanaged devices, and systems that routinely access external content.

Linux Patching

On Linux systems managed through a package repository, use the organization’s normal package-management workflow. For Debian-based systems, an example command is:

sudo apt-get update
sudo apt-get install --only-upgrade google-chrome-stable
pkill -x chrome || true
google-chrome --version

The pkill step should be used only under an approved endpoint-management procedure because it closes browser sessions. Verify the resulting version rather than assuming the package operation succeeded.

Windows Patching

On Windows, Chrome can be updated through enterprise software distribution, Google Update, or the browser’s managed update process. A deployment workflow should include version validation after installation, for example:

$chrome = Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe" `
  -ErrorAction SilentlyContinue

if ($chrome) {
  $version = [version]$chrome.VersionInfo.ProductVersion
  if ($version -lt [version]"157.0.8103.50") {
    Write-Error "Chrome remains below the minimum fixed version: $version"
  } else {
    Write-Output "Chrome version is $version"
  }
}

Where patching cannot occur immediately, temporarily reduce exposure by restricting access to untrusted websites, enforcing browser isolation or application allowlisting where available, and limiting high-risk browsing from privileged accounts. These are interim controls, not substitutes for the vendor update. Because the vulnerable path is reached through crafted HTML and exploitation is confirmed, organizations should not rely on disabling a single browser feature unless Google or the relevant Chromium-based product explicitly documents that control as an effective workaround.

Chromium-based downstream applications require separate verification. Identify the embedded Chromium version, consult the application vendor, and apply its security update. If no mitigation is available for a business-critical product, isolate it from untrusted content and assess whether it can be temporarily removed or replaced.

Incident Response for Potentially Exploited Endpoints

Investigate systems that ran an affected Chrome version during the known exploitation window, particularly endpoints associated with suspicious browsing activity, unexpected child processes, crashes, downloads, or credential access.

Recommended response steps include:

1. Preserve relevant endpoint, browser, proxy, DNS, and authentication logs.
2. Record the installed and running Chrome versions before remediation where possible.
3. Review browser history, downloads, redirects, and suspicious domains.
4. Examine process creation, command lines, persistence locations, and outbound connections.
5. Collect forensic evidence according to organizational procedures.
6. Reset potentially exposed credentials after determining the scope of access.
7. Reimage or isolate systems where compromise cannot be confidently ruled out.
8. Verify that all Chromium-based applications have been assessed separately.

Detection of a suspicious child process does not by itself prove exploitation. Correlate telemetry across time and sources, and avoid treating a clean post-update scan as evidence that no earlier compromise occurred.

References

1. NVD: CVE-2026-125350
2. Google Chrome Releases: Stable Channel Update for Desktop
3. Chromium issue 582442907
4. CISA Known Exploited Vulnerabilities Catalog
5. CVE.org record: CVE-2026-125350
6. SOC Prime coverage
7. Senserva CVE tracking page

Handle CVE-2026-125350 as an active browser exploitation issue rather than a routine patch-cycle item. Start by updating affected Chrome and Chromium deployments, then restart browser processes and validate fixed versions. Investigate endpoints that remained exposed after the vendor release, including unmanaged systems and downstream Chromium applications that require separate vendor confirmation.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.