Chrome: actively exploited use-after-free in XML (CVE-2026-125350)
Google released a Chrome update that patches nine vulnerabilities. One of them, CVE-2026-125350, is already exploited in the wild. It is a use-after-free bug in the XML component, with no CVSS score given.
Checked in Shield: no
Who is affected
Chrome is affected. The source does not list vulnerable version numbers. Also consider chromium on servers if it opens external pages.
How to check
Check whether chromium is installed on your server and whether it opens external pages. Look up the status of CVE-2026-125350 for chromium in the Debian Security Tracker.
How to fix
Install the Chrome update Google has released. For chromium on Debian, run apt upgrade once the package is available. If chromium is not needed, remove it or run it only in a sandbox.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version number and attack details are not disclosed yet. Source: The Hacker News.
