Chrome sandbox RCE actively exploited (CVE-2026-125350)

Actively exploited in the wild - CVE-2026-125350 is a high-severity use-after-free in XML parsing in Google Chrome prior to 157.0.8103.50 that lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page. Google has shipped the fix in Chrome 157.0.8103.50; update immediately, because exploitation has been confirmed.

Overview

CVE-2026-125350 is a memory-safety bug in Chrome’s XML handling code. When Chrome parses XML content from a page, it frees an object and then keeps using a pointer to it. An attacker who can trigger this sequence - typically by getting a victim to load a malicious HTML page - can take control of that freed memory and steer execution to code of their choosing.

The vulnerability carries a CVSS score of 8.8. It is network-exploitable, requires no privileges, and needs only that the victim visit a page or open a crafted document. Chromium rated its security severity as High. CISA has now added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog, confirming attackers are using it against real targets rather than leaving it as a theoretical risk.

Impact

A successful exploit lets the attacker run arbitrary code inside Chrome’s renderer sandbox. That sandbox is designed to contain damage, so the immediate blast radius is limited - but it is not a safe place to lose. From inside the sandbox an attacker can read the credentials and session tokens the browser can reach, exfiltrate data from open tabs, and chain a second sandbox-escape bug to break out onto the underlying host. In practice, an exploited browser is an entry point to the user’s accounts and, on many corporate endpoints, to internal web applications that trust the browser’s authenticated session.

Because the attack runs through ordinary HTML, phishing is trivial: a link, an ad frame, or a compromised legitimate site is enough. No download prompt and no elevated permissions are needed.

Remediation and mitigation

• Update Chrome to 157.0.8103.50 or later on Windows, macOS, and Linux. Restart the browser to apply the update; Chromium-based browsers (Edge, Brave, Opera, Vivaldi) ship the same underlying component and should be patched as their vendors publish fixes.
• Push the update through your endpoint management tool rather than relying on users. Exploited-in-the-wild browser bugs are exactly the case where forced updates are worth the friction.
• Verify versions fleet-wide. Chrome’s chrome://version page shows the running build; confirm no endpoints are stranded on older branches.
• Until patched endpoints are confirmed, treat browser browsing as an exposure path: restrict access to untrusted sites, and monitor for unusual process behavior from browser child processes.

For context on how quickly KEV additions translate into live attacks, see our coverage of Adobe Commerce and Brotli KEV activity and Oracle PeopleSoft exploitation with web shells. This bug fits the run of browser zero-days in our weekly roundup for June 8-14.

Security Insight

Sandboxed use-after-free bugs are usually rated down precisely because the attacker stays contained - but that reasoning breaks when a bug is confirmed exploited, since attackers chain a second flaw to escape. The pattern echoes the steady cadence of Chrome zero-days in memory-unsafe XML and parser code, a class that keeps returning despite years of investment in fuzzing and mitigations. For defenders, the lesson is that browser patch latency is now a monitored attack surface, not a housekeeping task.

Further Reading

• CISA adds Adobe Commerce and Brotli bugs to KEV
• Oracle PeopleSoft CVE-2026-35273 exploited, web shells
• Weekly Threat Roundup: Ivanti & Chrome Zero-Days (June 8-14)
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs