Critical Chromium Use-After-Free Flaw (CVE-2026-125350) Hits Chrome, Edge and Opera

En bref

• CVE-2026-125350 is a use-after-free in Chromium-based browsers, rated critical.
• Successful exploitation can yield arbitrary code execution, including inside the sandbox.
• Google, Microsoft and Opera all ship affected builds; a remote, unauthenticated attacker is the threat model.
• K-12 endpoints and admin consoles with internet exposure are the priority patching targets.
• Where no fix exists, agencies are directed to retire the browser rather than accept the risk.

A memory-safety defect tracked as CVE-2026-125350 has been disclosed in the Chromium engine that underpins several of the most widely deployed browsers in the department. The flaw is a use-after-free, meaning the browser can be tricked into referencing memory it has already released. An attacker who can lure a user to crafted web content can potentially turn that corruption into running their own code on the machine, and the impact extends into the browser's sandbox layer rather than stopping at the renderer.

Because the same engine is reused across products, the exposure is not limited to a single vendor. Google's Chrome, Microsoft's Edge and Opera all inherit the defect, so the department's mixed browser estate — including whatever ships by default on staff laptops and lab machines — is broadly in scope. The attacker does not need credentials or a foothold on the network; the initial vector is simply a browsing session, which makes this a perimeter-free problem.

The practical consequence for a K-12 environment is that patching cannot wait for the next maintenance window. Browser processes run with user privileges and touch email, learning platforms and administrative consoles, so a compromise there is a short hop to credential theft and lateral movement. Staff who browse freely, and any shared or kiosk device where users open untrusted links, carry the highest likelihood of triggering exploitation.

Remediation follows the vendors' own guidance plus the federal directive that governs this class of vulnerability. Where an update or mitigation is published, deploy it; where a product has no available fix, the directive's expectation is that the software is removed from service rather than left running. Alongside patching, teams should establish which browsers and management interfaces are actually reachable from the internet, since that inventory determines where the residual risk sits. Watch for vendor advisories expanding the affected version ranges, and treat any unexplained browser crash or outbound connection from a workstation as worth a look.

À faire maintenant

1. Inventory every Chromium-derived browser in use (Chrome, Edge, Opera, embedded webviews) and record versions against the vendors' fixed builds.
2. Push the vendor updates to all endpoints immediately, prioritizing staff laptops and any device that browses the open internet.
3. Where a supported fix is not yet available for a product, remove that browser from service and standardize on a remediated alternative.
4. Apply the mitigations published by Google, Microsoft and Opera, and verify they are actually enforced through your management console.
5. Align the rollout with Binding Operational Directive 26-04 timelines and document the remediation date for each asset.
6. Map internet-facing systems and administrative interfaces, then restrict or front them with additional access controls.
7. Monitor endpoint telemetry for browser process anomalies and alert on suspicious child processes or unexpected outbound traffic.

Source originale

CISA Known Exploited Vulnerabilities