Chrome zero-day CVE-2026-125350 under active exploitation
Google confirms in-the-wild exploitation of a Chrome use-after-free flaw among nine vulnerabilities enabling arbitrary code execution; patch to 157.0.8103.50/.51.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-125350 as exploited in the wild.
MS-ISAC has issued an advisory covering multiple vulnerabilities in Google Chrome, the most severe of which could allow arbitrary code execution in the context of the logged-on user. The vulnerabilities span several Chrome components including WebGL, FileSystem, Compositing, GPU, V8, and XML, and include uninitialized resource issues, incorrect authorization, buffer overflow, out-of-bounds write, type confusion, and use-after-free bugs. Google has confirmed that an exploit for CVE-2026-125350, a use-after-free vulnerability in XML, exists in the wild, making this a priority patch for all organizations running affected Chrome versions.
Affected systems include Chrome prior to version 157.0.8103.50/.51 for Windows and Mac, and prior to 157.0.8103.50 for Linux. Successful exploitation could allow attackers to install programs, view/change/delete data, or create new accounts with full user rights, with impact scaled to the privileges of the logged-on user. Exploitation is associated with drive-by compromise (initial access via malicious or compromised web content), meaning simply browsing to an attacker-controlled or compromised page could trigger exploitation.
Defenders should prioritize immediate patching to the fixed Chrome versions, apply least-privilege principles to limit impact of successful exploitation, and enable anti-exploitation features (DEP, Exploit Guard, SIP/Gatekeeper). Additional layered defenses include DNS/URL filtering, blocking unnecessary file types at email gateways, and browser isolation/sandboxing to reduce the blast radius of drive-by exploitation attempts.
Mentioned in this report
Detection guidance
Chrome Browser Spawning Script Interpreter or LOLBin
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
chrome.exe launching a shell, script host or download/proxy LOLBin, a post-exploitation sign of a browser drive-by exploit (e.g. a renderer or V8 memory-corruption bug) that achieved code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Browser Spawning Script Interpreter or LOLBin
id: 559da80d-324a-532b-b00a-317c4fd3a8e5
status: experimental
description: Detects chrome.exe directly spawning command shells, script hosts, or
download/proxy-execution LOLBins. Chrome rarely does this in normal operation, so
it can indicate successful drive-by exploitation of a browser vulnerability (such
as the Chrome use-after-free and type-confusion bugs) leading to code execution
in the context of the logged-on user.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_native_messaging:
CommandLine|contains: chrome-extension://
condition: selection and not filter_native_messaging
falsepositives:
- Browser extensions using native messaging hosts implemented as batch or PowerShell
scripts
- Enterprise tooling or developer workflows that launch scripts from Chrome through
custom protocol handlers
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-127
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-127
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs