Vulnerability
CVE-2026-125350 Deep Dive: Chromium libxslt Use-After-Free Zero-Day, In-the-Wild Exploitation, and Enterprise Hardening
An authoritative technical security analysis of CVE-2026-125350, the high-severity libxslt use-after-free zero-day actively exploited in Google Chrome. We deconstruct the pattern matching cache re-entrancy flaw in pattern.c, analyze renderer heap corruption mechanics, evaluate the CISA KEV exploitation timeline, and provide enterprise detection and XSLTEnabled mitigation strategies.
11 min read
CVE-2026-125350 Deep Dive: Chromium libxslt Use-After-Free Zero-Day, In-the-Wild Exploitation, and Enterprise Hardening
Executive Summary
On November 10, 2026, CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed in-the-wild zero-day exploitation against desktop browsers. Reported anonymously to Google on November 6, 2026, this high-severity flaw (CVSS v3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) impacts all Chromium browsers—including Chrome, Edge, Brave, and Opera—on Windows, macOS, and Linux prior to version 157.0.8103.50.
The vulnerability resides in Chromium's bundled libxslt library used by Blink to transform XML documents with XSLT stylesheets. The flaw stems from an unsafe direct pattern match cache in xsltTestCompMatchDirect() in pattern.c. When processing nested expressions (such as xsl:number counters or global variables), the evaluator re-enters pattern matching routines, deallocating cached objects while outer function frames retain stale pointers—triggering a Use-After-Free (UAF) condition.
By delivering a crafted webpage via <?xml-stylesheet?> directives or the XSLTProcessor JavaScript API, a remote attacker can corrupt renderer heap structures and achieve arbitrary code execution within the renderer sandbox upon navigation. In active campaigns, adversaries pair this renderer compromise with local privilege escalation or broker flaws to achieve full host takeover.
This technical analysis examines CVE-2026-125350: pattern cache re-entrancy in C, PartitionAlloc heap manipulation, exploit delivery vectors, and enterprise defense playbooks.
+----------------------------------------------------------------------------------------------------+
| CVE-2026-125350 Exploit Lifecycle and Memory Topology |
+----------------------------------------------------------------------------------------------------+
| |
| [ Remote Web Attacker ] |
| | |
| v (Delivers Malicious HTML/XML with Embedded XSLT Stylesheet) |
| +----------------------------------------------------------------------------------------------+ |
| | CHROME RENDERER SANDBOX (Untrusted Web Execution Environment) | |
| | | |
| | Blink DOM Parser | |
| | | | |
| | v (Initializes XSLT Transformation via XSLTProcessor API) | |
| | libxslt Engine (pattern.c) | |
| | | | |
| | +---> 1. xsltTestCompMatchDirect() caches xmlXPathObjectPtr | |
| | | | |
| | +---> 2. Nested XPath Evaluation re-enters xsltTestCompMatchDirect() | |
| | | - Replaces and frees cached slot in xsltCompMatchCache | |
| | | | |
| | +---> 3. Outer scope continues execution using freed pointer (USE-AFTER-FREE) | |
| | | | |
| | v | |
| | Heap Grooming / Spraying via PartitionAlloc | |
| | | | |
| | v | |
| | Arbitrary Code Execution in Renderer Sandbox (Shellcode Execution) | |
| +----------------------------------------------------------------------------------------------+ |
| | |
| v (Requires Secondary Sandbox Escape / Broker Bug to Reach Operating System) |
| +----------------------------------------------------------------------------------------------+ |
| | CHROME BROWSER PROCESS / OS KERNEL (Protected Host Operating System) | |
| +----------------------------------------------------------------------------------------------+ |
| |
+----------------------------------------------------------------------------------------------------+
1. Vulnerability Anatomy: The libxslt Direct Match Cache Flaw
To understand how CVE-2026-125350 manifests, one must analyze how the Blink rendering engine interfaces with libxslt to process XML document transformations.
XSLT Processing Architecture in Chromium
When a browser loads an XML document containing an XSLT processing instruction or when JavaScript invokes new XSLTProcessor().transformToDocument(), Chromium passes the document object model (DOM) to libxslt. The core engine matches nodes against stylesheet templates defined by xsl:template match="..." expressions.
Because pattern evaluation against deep XML document trees is computationally expensive, libxslt implements an internal direct match cache in pattern.c. The purpose of this cache is to store intermediate XPath node-sets (xmlXPathObjectPtr) during complex structural evaluations, avoiding repeated traversal of the XML tree for identical node contexts.
/* Vulnerable Architectural Concept in libxslt (pattern.c) prior to commit 61cab3f77203 */
int xsltTestCompMatchDirect(xsltTransformContextPtr ctxt,
xsltCompMatchPtr comp,
xmlNodePtr node,
const xmlChar *name,
const xmlChar *mode,
const xmlChar *modeURI) {
xmlXPathObjectPtr cachedList = NULL;
int ret = 0;
/* 1. Retrieve or allocate the cached XPath evaluation object */
cachedList = ctxt->compMatchCache;
if (cachedList == NULL) {
cachedList = xsltEvaluatePatternXPath(ctxt, comp, node);
ctxt->compMatchCache = cachedList; /* Store pointer in global transform context */
}
/* 2. Execute pattern matching logic against the cached node-set */
ret = xsltMatchNodeList(comp, node, cachedList);
/*
* 3. CRITICAL FLAW: The function assumes it retains exclusive ownership
* of ctxt->compMatchCache across any sub-evaluations.
*/
if (ctxt->compMatchCache != NULL) {
xmlXPathFreeObject(ctxt->compMatchCache); /* Free the memory */
ctxt->compMatchCache = NULL;
}
/* If a nested evaluation re-entered this function, cachedList now points to freed memory! */
return ret;
}
The Re-Entrancy Trap and Double-Free / Use-After-Free
The fatal flaw in xsltTestCompMatchDirect() lies in the assumption that the context's cache pointer (ctxt->compMatchCache) remains static during the execution of xsltMatchNodeList().
In complex stylesheets, pattern matching triggers secondary operations:
- Variable Resolution: Referencing uncomputed
xsl:variableorxsl:paramvalues pauses pattern evaluation to invoke the XPath interpreter. - Contextual Numbering: Instructions like
xsl:numberinspect sibling and ancestor trees to derive document sequences. - Re-entrant Invalidation: Nested evaluation re-enters
xsltTestCompMatchDirect()for child nodes, freeing the sharedctxt->compMatchCacheobject, allocating a new object, and freeing it upon return. - Stale Pointer Access: Unwinding back to the outer function leaves the local
cachedListvariable pointing to freed memory. Subsequent reads or cleanup calls trigger use-after-free and double-free crashes.
+---------------------------------------------------------------------------------------------------+
| Call Sequence Leading to Use-After-Free |
+---------------------------------------------------------------------------------------------------+
| 1. Outer Frame: xsltTestCompMatchDirect() called on Root Node |
| -> ctxt->compMatchCache allocated at Heap Address [0x0041a000] |
| 2. Outer Frame calls xsltMatchNodeList() |
| -> Triggers resolution of dynamic stylesheet variable $nav_counter |
| 3. Inner Frame: XPath evaluator invokes xsltTestCompMatchDirect() on Child Node |
| -> Nested call frees ctxt->compMatchCache [0x0041a000] |
| -> Nested call re-allocates ctxt->compMatchCache at [0x0041b000] |
| -> Nested call finishes and frees [0x0041b000] |
| 4. Control returns to Outer Frame |
| -> Outer frame accesses local cachedList pointing to freed address [0x0041a000] (UAF!) |
+---------------------------------------------------------------------------------------------------+
2. Heap Exploitation Mechanics in Chromium's PartitionAlloc
In modern Chromium releases, memory safety is heavily guarded by PartitionAlloc, a specialized, hardened heap allocator designed explicitly to prevent common heap exploitation primitives:
- Object Segregation: Isolates different object types into dedicated partitions (e.g.,
BufferPartition,FastMalloc, andLayoutObjectpartitions). - Metadata Protection: Stores chunk metadata out-of-line from data payloads to mitigate buffer overflow overwrites.
- GigaCage Virtual Address Space: Enforces pointer compression and 32-bit offsets within a multi-gigabyte virtual sandbox.
Despite these advanced defensive mitigations, use-after-free vulnerabilities within external bundled libraries like libxslt remain viable exploitation vectors due to memory allocation boundaries.
The Heap Spray and Object Replacement Primitive
In CVE-2026-125350, the vulnerable xmlXPathObject structure is allocated through standard memory wrappers that interface with PartitionAlloc's regular malloc pool. The memory layout of an xmlXPathObject contains both raw data and pointers:
struct _xmlXPathObject {
xmlXPathObjectType type;
xmlNodeSetPtr nodesetval;
int boolval;
double floatval;
xmlChar *stringval;
void *user;
int index;
void *user2;
int index2;
};
When ctxt->compMatchCache is freed prematurely by the nested invocation, its memory slot within the PartitionAlloc bucket is marked as free and placed into the allocator's free-list.
Exploitation follows five sequential phases:
- Heap Grooming: JavaScript in the renderer thread sprays objects matching
sizeof(xmlXPathObject)(48–64 bytes) to shape PartitionAlloc bucket layouts. - Chunk Reclamation: As the nested call deallocates
compMatchCacheat0x0041a000, the spray reclaims the freed virtual address with controlled payload data. - Type Confusion: Outer routine execution treats attacker data as an authentic
xmlXPathObject, craftingnodesetvalto establish arbitrary memory read/write primitives. - ASLR Bypass: Memory disclosure primitives locate base addresses for
chrome.dllorlibchrome.so, calculating offsets for Return-Oriented Programming (ROP) chains. - Control Flow Hijack: Overwriting internal DOM callbacks redirects execution to attacker shellcode inside the renderer sandbox.
3. Threat Intelligence, In-the-Wild Exploitation, and the CISA KEV Timeline
CVE-2026-125350 represents the eighth actively exploited Google Chrome zero-day discovered in 2026, underscoring a continuous offensive campaign targeting client-side browser engines.
+---------------------------------------------------------------------------------------------------+
| Chronological Incident and Patch Timeline: CVE-2026-125350 |
+---------------------------------------------------------------------------------------------------+
| Date / Time | Milestone / Action Taken |
+----------------------------+----------------------------------------------------------------------+
| October 12, 2026 | Arni Hardarson (Neonix Security) reports related UAF CVE-2026-125346 |
| November 6, 2026 | Anonymous researcher reports active zero-day CVE-2026-125350 to Google|
| November 7, 2026 | Chromium lands commit 61cab3f77203 fixing the pattern match cache |
| November 9, 2026 | Google releases Chrome Stable 157.0.8103.50/.51 with emergency patch |
| November 10, 2026 | CISA adds CVE-2026-125350 to Known Exploited Vulnerabilities Catalog |
| November 10, 2026 | Brave updates to version 1.99.56 (Chromium 157.0.8103.50 base) |
| November 24, 2026 | Binding Operational Directive (BOD 22-01) federal remediation deadline|
+---------------------------------------------------------------------------------------------------+
Exploit Delivery and Campaign Profile
Telemetry links CVE-2026-125350 to targeted campaigns:
- Watering Hole Delivery: Compromised industry portals host malicious
<?xml-stylesheet?>headers, triggering parsing automatically upon navigation without file downloads or permission prompts. - Malvertising Vectors: Malicious XSLT payloads delivered inside ad iframes execute silently across high-traffic web properties.
- Exploit Chaining & Sandbox Escape: CVE-2026-125350 yields execution inside Chromium's restricted renderer sandbox (no filesystem write, no process spawning). Threat actors chain this renderer bug with Windows kernel LPEs or Mojo IPC broker flaws to achieve host persistence.
4. Empirical Vulnerability & Patch Analysis
Google resolved CVE-2026-125350 across all desktop platforms in Chromium commit 61cab3f77203. The patch simultaneously resolved CVE-2026-125346, confirming that both vulnerabilities exploited identical cache lifecycle flaws.
Source Code Diff: How Google Neutralized the Bug
The fix eliminates the shared global context cache for direct pattern matches, replacing it with a strictly scoped, stack-allocated evaluation model that prevents re-entrant invalidation:
--- a/third_party/libxslt/src/pattern.c
+++ b/third_party/libxslt/src/pattern.c
@@ -1042,16 +1042,22 @@ xsltTestCompMatchDirect(xsltTransformContextPtr ctxt,
const xmlChar *name,
const xmlChar *mode,
const xmlChar *modeURI) {
- xmlXPathObjectPtr cachedList = NULL;
+ xmlXPathObjectPtr list = NULL;
int ret = 0;
- cachedList = ctxt->compMatchCache;
- if (cachedList == NULL) {
- cachedList = xsltEvaluatePatternXPath(ctxt, comp, node);
- ctxt->compMatchCache = cachedList;
- }
+ /*
+ * FIX: Remove global ctxt->compMatchCache caching entirely.
+ * Evaluate XPath expression into a local, isolated object that cannot
+ * be mutated or freed by nested evaluations.
+ */
+ list = xsltEvaluatePatternXPath(ctxt, comp, node);
+ if (list == NULL)
+ return 0;
- ret = xsltMatchNodeList(comp, node, cachedList);
+ ret = xsltMatchNodeList(comp, node, list);
+
+ /* Explicitly free local object immediately after evaluation */
+ xmlXPathFreeObject(list);
return ret;
}
By removing ctxt->compMatchCache, libxslt guarantees that every evaluation maintains strict lexical ownership of its xmlXPathObject. Even if an inner evaluation executes recursive XSLT instructions, it cannot alter or deallocate the outer function's local node-set pointer.
+---------------------------------------------------------------------------------------------------+
| Chromium Desktop Distribution Patch Matrix |
+---------------------------------------------------------------------------------------------------+
| Browser Platform | Vulnerable Versions | Patched Secure Baseline |
+-------------------------------+-----------------------------------+-------------------------------+
| Google Chrome (Windows/macOS) | Versions < 157.0.8103.50 / .51 | Version 157.0.8103.50 / .51 |
| Google Chrome (Linux) | Versions < 157.0.8103.50 | Version 157.0.8103.50 |
| Chrome Extended Stable | Versions < 156.0.8078.96 | Version 156.0.8078.96 |
| Brave Browser | Versions < 1.99.56 | Version 1.99.56+ |
| Microsoft Edge | Versions < 157.0.8103.50 | Awaiting Vendor Upstream Sync |
| Opera Browser | Versions based on Chromium < 157 | Awaiting Vendor Upstream Sync |
+---------------------------------------------------------------------------------------------------+
5. Systems Engineering & Enterprise Hardening Playbook
Because zero-day browser exploits can compromise endpoints before automated update cycles conclude, enterprise security teams must deploy multi-layered defensive controls.
1. Emergency Enterprise Group Policy: Disabling XSLT
Organizations unable to verify 100% patch deployment across remote or unmanaged fleets can instantly neutralize the entire attack surface by disabling Chromium's XSLT engine via Group Policy. Starting in Chrome 146 and Microsoft Edge 147, Chromium exposed the XSLTEnabled administrative policy.
Windows Registry Enforcement
Deploy the following registry keys via Active Directory GPO or Intune:
# Disable XSLT in Google Chrome
New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Name "XSLTEnabled" -Value 0 -Type DWord
# Disable XSLT in Microsoft Edge
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge" -Name "XSLTEnabled" -Value 0 -Type DWord
macOS Configuration Profile (.mobileconfig)
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadType</key>
<string>com.google.Chrome</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>XSLTEnabled</key>
<false/>
</dict>
</array>
</dict>
</plist>
Operational Impact Note: Disabling XSLT breaks client-side rendering for legacy XML feeds that rely on browser-side styling. Modern web applications utilize JSON and server-rendered HTML; fewer than 0.01% of modern enterprise web properties require client-side XSLT.
2. Threat Hunting and SIEM Detection Rules
Security Operations Centers (SOC) must monitor endpoint telemetry for crash patterns and anomalous child processes originating from browser renderers.
Kusto Query Language (KQL) for Microsoft Sentinel & Defender for Endpoint
// Detect abnormal renderer crash bursts followed by process spawning
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "brave.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ (BrowserProcesses)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "rundll32.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
Sigma Rule: Suspicious Browser Process Creation
title: Suspicious Process Spawning from Browser Renderer
id: e4b29c18-912a-4f51-b883-cve2026125350
status: experimental
description: Detects suspicious command execution originating from Chromium browser processes following potential renderer exploit
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\\chrome.exe'
- '\\msedge.exe'
- '\\brave.exe'
Image|endswith:
- '\\cmd.exe'
- '\\powershell.exe'
- '\\rundll32.exe'
- '\\whoami.exe'
condition: selection
falsepositives:
- Legitimate enterprise software updaters
level: critical
tags:
- attack.execution
- attack.t1203
- cve.2026.125350
6. Semantic FAQ: CVE-2026-125350 and Chromium Security
What is the primary root cause of CVE-2026-125350?
CVE-2026-125350 is caused by an unsafe direct pattern match caching implementation in Chromium's bundled libxslt library (pattern.c). When processing nested XPath expressions during an XSLT transformation, the pattern matcher re-enters evaluation routines and deallocates cached objects while outer function frames still maintain pointers to them, resulting in a use-after-free condition.
Can an attacker compromise a full computer using only CVE-2026-125350?
No. Code executed via CVE-2026-125350 runs entirely within Chromium's sandboxed renderer process. To compromise the underlying operating system, install malware, or access local files, attackers must pair this vulnerability with a secondary exploit—such as a Windows/Linux kernel flaw or a Chrome browser broker IPC bug—to escape the sandbox.
Why is CVE-2026-125350 considered critical if it only has a CVSS score of 8.8?
Under the Common Vulnerability Scoring System (CVSS v3.1), vulnerabilities constrained within a sandbox receive an 8.8 (High) rating rather than 10.0 (Critical) due to the scope parameter (S:U). However, in practical offensive security, confirmed active exploitation in the wild makes CVE-2026-125350 an emergency operational threat requiring immediate remediation.
Does updating Chrome protect against the vulnerability if the browser is not restarted?
No. Chromium applies software updates in the background, but vulnerable binary modules remain resident in memory until all browser processes and background helper daemons are completely terminated and restarted. Systems administrators should enforce restart policies to ensure the patched version 157.0.8103.50 is active.
How does the XSLTEnabled policy neutralize the exploit?
The XSLTEnabled policy turns off the entire XSLT transformation subsystem in Blink. When disabled, Chromium rejects <?xml-stylesheet?> directives and blocks the XSLTProcessor API entirely, preventing malicious web pages from reaching the vulnerable libxslt pattern matching code.
Are mobile browsers (Chrome for Android and iOS) vulnerable?
Chrome for Android shares the Chromium codebase and requires updating to version 157.0.8103.50. Conversely, Chrome for iOS uses Apple's WebKit rendering engine due to App Store requirements and does not utilize Chromium's libxslt pipeline, making it immune to CVE-2026-125350.