CVE-2026-125350 - Use-After-Free Vulnerability

Lookout Coverage and Recommendation for Admins

Lookout is scheduled to release security coverage for CVE-2026-125350 for both Google Chrome (Android) and Microsoft Edge (Android) on November 19, 2026. Once these updates are live, the platform will automatically generate alerts and trigger remediation workflows based on each administrator's predefined risk, response, and escalation configurations.

To ensure mobile endpoints are protected, Lookout administrators should take the following actions in the Lookout console:

Enable the Application Vulnerability Policy: Detect when a vulnerable application version is installed on an enrolled device and enforce conditional access policies to block access to corporate data until updates are applied.
Remediate Browser Versions: Update devices running vulnerable versions of Google Chrome (below 157.0.8103.50) and Microsoft Edge for Android (below 157.0.4341.53), and verify that other downstream Chromium browsers are updated as vendor builds become available.
Enable Lookout Phishing & Content Protection (PCP): Protect mobile users by inspecting and blocking malicious links, phishing campaigns, and web vectors designed to trigger browser exploit chains.

Overview

Google disclosed a high-severity security vulnerability on November 10, 2026, affecting Chromium-based browsers. CVE-2026-125350 is a use-after-free vulnerability in the XML component of Google Chrome and the underlying Chromium architecture.

This high-severity flaw stems from a memory safety violation, specifically improper memory management and reuse of freed memory within the browser’s XML parser, which allows for unauthenticated remote code execution inside the browser sandbox. An attacker can exploit this vulnerability by persuading a user to visit a malicious website or load a specially crafted HTML page. While execution is initially confined to the browser's sandbox, this vulnerability can serve as a critical stepping stone in multi-stage exploit chains designed to compromise host systems, bypass sandbox boundaries, and exfiltrate sensitive enterprise data.

CVE-2026-125350 has been patched in Google Chrome starting with version 157.0.8103.50, and in Microsoft Edge for Android starting with version 157.0.4341.53. Administrators should verify Chrome and Edge builds across the fleet and continue monitoring other downstream Chromium vendors (such as Opera and Brave) to deploy corresponding security updates as soon as they are pushed to app stores. Devices running unpatched builds remain vulnerable and require immediate updates.

United States government organizations following CISA frameworks must have all vulnerable devices patched by November 24, 2026. While this mandate specifically applies to federal agencies, enterprise organizations are strongly advised to enforce immediate remediation across all mobile and desktop endpoints to reduce risk.

Lookout Analysis

MThis exploit poses a significant risk to Confidentiality, Integrity, and Availability. Successful exploitation enables attackers to execute arbitrary code within the sandboxed browser process, facilitating unauthorized actions and potentially accessing sensitive session data including authentication tokens, session cookies, and user PII.

The exploitation of CVE-2026-125350 follows these stages:

Luring: The user is induced to visit a malicious link, browse a compromised website, or open an attacker-controlled HTML asset.
Triggering: The browser renders the crafted content, invoking the underlying XML parsing component.
Memory Corruption: The application accesses memory after it has been freed (use-after-free), corrupting heap state and redirecting program control flow.
Accessing: The attacker achieves arbitrary code execution within the sandbox and accesses application memory, exposing session tokens and credentials.
Post-Exploitation: The attacker leverages sandbox code execution in conjunction with secondary privilege escalation or sandbox escape zero-days to pivot across host processes or exfiltrate sensitive corporate data.