Google Chrome: use after free in XML (CVE-2026-125346)
CVE-2026-125346 has been published: a use-after-free in the XML component of Google Chrome. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. CVSS is 8.8, Chromium severity: High.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.50 are affected. This also applies to the chromium package on servers if it opens untrusted content.
How to check
Check the installed Chrome or chromium version. Find out what chromium is used for on the server and whether it opens untrusted pages.
How to fix
A fix exists: Google Chrome 157.0.8103.50 and later. Watch for the chromium update in Debian security and install it. If chromium is not needed, remove the package.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD.
