-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 NEFARIOUSPLAN-CANONICAL-V1 {"body_md":"## What Google shipped on November 9\n\nThe Chrome Stable Channel Update for Desktop that landed at 12:52 PT on November 9, 2026 announced `157.0.8103.50/.51` for Windows and Mac and `157.0.8103.50` for Linux, with nine security fixes. The Extended Stable Update seven minutes earlier announced `156.0.8078.96` with eleven security fixes. The Android release followed at 15:00 PT with Chrome 157. Four of the Stable fixes and eleven of the Extended Stable fixes include the same CVE identifiers; CVE-2026-125350 is one of them.\n\nTwo of the fixes in the Stable release are tagged `Use after free in XML`:\n\n```text\n[TBD][ 572578603 ] High CVE-2026-125346: Use after free in XML.\n Reported by Arni Hardarson (Neonix Security) on 2026-10-12\n[N/A][ 582442907 ] High CVE-2026-125350: Use after free in XML.\n Reported by anonymous on 2026-11-06\n```\n\nBoth Chromium bug IDs are restricted. The release note's standard prefix applies: `Access to bug details and links may be kept restricted until a majority of users are updated with a fix.` The restriction holds for `crbug 582442907` as of this writing. Nobody outside Google and the anonymous reporter can read the bug.\n\nOne sentence in the release note is attached to the second CVE and not the first:\n\n> Google is aware that an exploit for CVE-2026-125350 exists in the wild.\n\nThis is the Disclosure After Exploitation shape in a Chromium-specific form. The anonymous attribution and the in-the-wild line together establish that the report arrived from somebody watching exploitation happen, not from a named researcher claiming credit. Three days between the anonymous report and the Stable release. One day between the Stable release and the CISA KEV addition. Twelve hours between the CISA KEV addition and the two public repositories whose names contain the string `CVE-2026-125350`. The anonymous reporter wrote working exploit bytes that Google used to produce the patch. Neither of the two public authors wrote anything that reaches the parser.\n\n## ashrafzaryouh/CVE-2026-125350 is a version checker that misses Extended Stable\n\n`ashrafzaryouh/CVE-2026-125350` is one file, `CVE-2026-125350.html`, 5,845 bytes, first commit at 14:54 UTC on November 10. The commit graph shows four edits over twenty-eight minutes by `Ashraf Zaryouh `. The HTML renders a card with a header `CVE-2026-125350` under a subtitle labelling it the `Chrome XML Use-After-Free Safe Status Checker`, and a footer:\n\n> This tool only reads the browser version string.\n> No XML is parsed, no memory operations, no exploit code.\n\nThe script reads `navigator.userAgentData.getHighEntropyValues(['fullVersionList'])` (with a `navigator.userAgent` regex fallback), parses the Chrome version into a four-element integer array, and compares it against a hardcoded constant:\n\n```javascript\nconst FIXED = [157, 0, 8103, 50];\n\nfunction isPatched(ver) {\n if (!ver) return false;\n for (let i = 0; i < 4; i++) {\n if (ver[i] > FIXED[i]) return true;\n if (ver[i] < FIXED[i]) return false;\n }\n return true; // equal is patched\n}\n```\n\nThe constant matches the Stable Channel version Google announced on November 9. It does not match the Extended Stable Channel version Google announced seven minutes before it. A user whose browser reports `156.0.8078.96` is tested against `FIXED[0] = 157`, the first iteration fails `ver[0] < FIXED[0]`, and `isPatched` returns `false`. The checker labels the user `VULNERABLE` and tells them to update:\n\n> Your browser version is vulnerable.\n> Update Chrome immediately to 157.0.8103.50 or later and restart the browser.\n\nChrome Extended Stable is the release channel enterprise operators configure when they want security fixes without feature-change churn. The November 9 Extended Stable update includes CVE-2026-125350. A security team that rolled 156.0.8078.96 to its managed fleet on November 10 and then ran the checker, searching for reassurance before the KEV deadline, is told its patched fleet is unpatched. The thing the checker names as the fixed version is one of two fixed versions. The thing the checker tells the user to do, update to 157, is not an option on the channel they are running. The author read the Stable Channel Update post and did not scroll up to the Extended Stable Update post sitting above it.\n\nThe HTML does nothing an existing browser-accessible page does not already do. `chrome://settings/help` shows the user their Chrome version and whether an update is available, authoritatively, without a CVE-named GitHub repository in the loop. The thing the checker adds to that workflow is a CVE identifier on the badge and a hardcoded version comparison that gets the Extended Stable case wrong.\n\n## Frostmoon39206/CVE-2026-125350-PoC is a placeholder with two different proton inboxes\n\n`Frostmoon39206/CVE-2026-125350-PoC` is five tracked paths at HEAD: `README.md`, `exploit.py`, `requirements.txt`, `LICENSE`, and `screenshots/poc.png`. The commit graph shows eight commits in a seventeen-minute window starting at 21:34 UTC on November 10 by `Frostmoon39206 `, with the committer identity renamed to `DeFrost` mid-session against the same email. The first three commits dropped `exploit.py` and `requirements.txt` into a `screenshots/` subdirectory by accident; the author deleted them and re-uploaded them at the tree root.\n\nThe README's `Affected Versions` section:\n\n```markdown\n## Affected Versions\n* Google Chrome < 134.0.6998.45\n* Chromium-based browsers (Microsoft Edge, Brave, Opera) < equivalent builds\n*(Note: Verified on Chrome 133.0.6943.126 and 134.0.6998.35 on Linux)*\n```\n\nGoogle shipped Chrome `134.0.6998.45` in February 2025. The anonymous CVE-2026-125350 report landed in November 2026 against a Chrome Stable branch twenty-three majors downstream of it. The three version numbers in the README (`134.0.6998.45`, `133.0.6943.126`, `134.0.6998.35`) are all from Chrome's early-2025 release window; none of them have any operational relationship to the bug the repository's name identifies. The README names a vulnerability window that closed twenty months before the anonymous reporter filed.\n\n`exploit.py` is 76 lines. The function the CLI runs on `--generate`:\n\n```python\ndef generate_xml_payload():\n \"\"\"\n Generates the base XML structure required to reach the vulnerable parser.\n The malicious UAF trigger is intentionally omitted in this public version.\n \"\"\"\n print(\"[*] Generating base XML structure (skeleton)...\")\n\n # Standard XML template used to reach the parser state\n xml_template = \"\"\"\n\n \n fuzz_input_here\n \n \n \n \n\"\"\"\n\n # TODO: Implement heap grooming and UAF trigger logic here.\n # This requires precise object alignment and memory manipulation,\n # which is restricted to the commercial version.\n\n print(\"[+] Base XML generated. Trigger logic disabled.\")\n return xml_template\n```\n\nThe template is nine lines of inert XML and one HTML comment admitting the trigger is absent. The `TODO` comment below the return value names exactly the primitive the CVE describes and explicitly states it is not present. `requirements.txt` declares `requests>=2.31.0` and `lxml>=4.9.3`; `exploit.py` imports neither. The dependencies are decoration for the template. This is the [Placeholder PoC](/patterns/placeholder-poc) pattern in its canonical form: a tracked exploit script whose own source names the gap between what the script does and what the CVE describes.\n\nThe README's sales section:\n\n> ## Access & Terms\n> The public code in this repository is intentionally restricted and non-functional to prevent automated abuse by scanners.\n>\n> If you are a pentester, red teamer, or vulnerability researcher looking to acquire the full, weaponized Proof-of-Concept, contact for private access:andysnyderef1982@proton.me\n>\n> Please include your intended use case and target environment. Commercial licensing terms are available upon request.\n\nThe `exploit.py` module docstring advertises a different address:\n\n```python\n\"\"\"\nCVE-2026-125350 / EUVD-2026-121390\nGoogle Chrome XML Use-After-Free (CWE-416)\n\n*** SKELETON ONLY ***\nThis script is a non-weaponized proof-of-concept.\nIt generates the base XML structure required to reach the parser,\nbut DOES NOT contain the heap grooming or UAF trigger required for RCE.\n\nFor access to the full weaponized pipeline, contact: your-sales@proton.me\n\"\"\"\n```\n\nThe README's sales contact is `andysnyderef1982@proton.me`. The exploit.py's sales contact is `your-sales@proton.me`. One of the two is the author's intended sales channel. The other is a template string the author did not search-and-replace. The buyer cannot tell which. The seller does not need to decide; the seller needs one proton inbox to receive mail from whoever thinks the KEV deadline is worth trying both. This is the [Paywall PoC](/patterns/paywall-poc) pattern: the README is a storefront, the repository tree is the storefront's facade, and the product is what the buyer believes about the bytes at the moment of payment.\n\n`screenshots/poc.png` is the storefront's advertisement. It is a 32 KB terminal-screenshot composite showing claimed output of the private version:\n\n```\n[*] Target: https://█████████\n[*] Sending crafted XML payload...\n[*] Triggering UAF...\n[+] Memory corruption successful.\n[+] Arbitrary read/write achieved.\n[*] Executing command: id\nuid=1000(chrome) gid=1000(chrome) groups=1000(chrome),4(adm),24(cdrom)\n```\n\nThe target URL is blurred. The output is text. The hostname (`render-node-01`) and kernel string (`Linux render-node-01 6.1.0-13-amd64 ... Debian 6.1.55-1 (2026-10-28)`) are plausible but unverifiable. Nothing in the image is a reproducible artifact. The screenshot is marketing. The seller does not need a working exploit to render it; the seller needs a terminal and a screenshot tool. Everything the image testifies to is a claim the buyer evaluates after they pay `andysnyderef1982@proton.me` or `your-sales@proton.me` or both.\n\n## The anonymous reporter has the primitive\n\nBoth XML use-after-frees Chrome fixed on November 9 are restricted in the Chromium issue tracker. `crbug 572578603` (CVE-2026-125346) is `[TBD]`; `crbug 582442907` (CVE-2026-125350) is `[N/A]`. Chrome's bug restriction clause covers both: details and links remain withheld until a majority of users are updated. The two researchers who found the bugs made different attribution choices. Arni Hardarson of Neonix Security put their name on CVE-2026-125346, reported on October 12. The reporter of CVE-2026-125350, filed on November 6, chose anonymity. Google's in-the-wild acknowledgement attaches to the second, not the first.\n\nNeither researcher published a PoC. Chromium's bug tracker is the only public surface the primitive would appear on, and both tickets are restricted. The vulnerability-intelligence pipeline that polls GitHub for `CVE-2026-125350`-named repositories registered the two repositories above as `PoC available`; the bug the scanner graded a 10 on is sealed inside a locked issue tracker that neither author has read. The anonymous reporter has the primitive. Google has the primitive. The two GitHub authors have an identifier, a template, and a KEV deadline to price against.\n\nThis is the second time in five months this blog has covered the same shape against a Chrome KEV bug. The June 23 federal civilian deadline for CVE-2026-11645, a V8 out-of-bounds read and write, [arrived with three CVE-named repositories on GitHub](/posts/cve-2026-11645-v8-kev-three-pocs-no-oob): a tab-crasher, a Spanish-language chatbot transcript containing uncompilable JavaScript, and a TinyURL redirecting to a payment platform. The three repositories collectively performed zero out-of-bounds reads and zero out-of-bounds writes. They registered identically on the pipeline that counts CVE-named repositories as weaponization evidence. Today's two CVE-2026-125350 repositories are the smaller, faster version of the same workflow. The economic shape of [Paywall PoC](/patterns/paywall-poc) does not depend on the bug class. It depends on the KEV deadline and the scanner's willingness to count repository names.\n\nThe playbook has been written. Run `git ls-tree -r HEAD` before treating any CVE-named repository as evidence of a public PoC. Compare the README's affected-versions table against the vendor's release blog. Resolve every outbound contact in a sales section before scoring the artifact. The two repositories above fail at the tree-listing layer; the Frostmoon39206 repository additionally fails at the version-table layer, the file-imports layer, the dependency-manifest layer, and the sales-contact-consistency layer. Reading the two files is the review. Neither needs to be opened in a sandbox, and neither needs to be reverse-engineered.\n\nThe scanner that polls GitHub for `CVE-2026-125350` logged `gh-search+2` and did not open the files. The vulnerability intelligence pipeline that consumed that signal added `multi-poc×2+1` for the second repository. The federal civilian SOC analyst searching GitHub for a PoC to validate their detection posture before November 24 finds the version checker and the skeleton, in that order of upload. The checker does not help them. The skeleton tells them to email a proton inbox.\n\nPoCs: [ashrafzaryouh/CVE-2026-125350](https://github.com/ashrafzaryouh/CVE-2026-125350), [Frostmoon39206/CVE-2026-125350-PoC](https://github.com/Frostmoon39206/CVE-2026-125350-PoC).","closing_line":"Chrome's release blog named the fix on November 9. The anonymous reporter had the primitive. The two authors who published on November 10 had the identifier, a template, and twelve hours.","hook_md":"CVE-2026-125350 is a use-after-free in Chrome's XML component. Google patched it on November 9, 2026, in Stable `157.0.8103.50/.51` and Extended Stable `156.0.8078.96`, credited an anonymous reporter who filed three days earlier, and attached a sentence to the release note that does not appear next to any other CVE in the update: `Google is aware that an exploit for CVE-2026-125350 exists in the wild.` CISA added the identifier to the Known Exploited Vulnerabilities catalog on November 10 with a federal civilian remediation deadline of November 24. Two GitHub repositories whose names contain the string `CVE-2026-125350` were published within twelve hours of the KEV listing. One of them tells a user on patched Extended Stable that their browser is vulnerable. The other names an affected-versions range that ends before Chrome 134, which Google shipped in February 2025.","post_id":855,"slug":"cve-2026-125350-chrome-xml-uaf-two-pocs-neither-knows-chrome","title":"CVE-2026-125350: Chrome's XML UAF KEV Lands Two PoCs Within Twelve Hours. One Flags Patched Users Vulnerable. The Other Describes A Chrome From February 2025.","type":"initial","unreadable_sentence":"One public PoC flags patched Extended Stable users as vulnerable. The other names an affected-versions range that closed twenty months before the bug it describes was reported."} -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQRf0htP5+SjynlxywneZjl4jgkQJgUCavOg8gAKCRDeZjl4jgkQ Jr6wAP9ziTV7Ad++LYfEtl/P6HMEO7FbSFWOa0FMdMcd9RNIJQEAmHZ2CRYiMuQ7 Xj0V8eCqiSxoLaa35KPW6DR6Ppv46AQ= =KXLw -----END PGP SIGNATURE-----