Google has patched a Chrome zero-day that it says attackers are already exploiting. The flaw, CVE-2026-125350, is a use-after-free bug in Chrome’s XML component, fixed in the desktop update Google released on Nov. 9. If your browser is older than version 157.0.8103.50, update it and relaunch.
What happened
Google’s Stable channel update for desktop moves Chrome to 157.0.8103.50 or .51 on Windows and Mac and 157.0.8103.50 on Linux, rolling out over the coming days and weeks. The release carries nine security fixes. Google rates CVE-2026-125350 as High and credits an anonymous researcher who reported it on Nov. 6. Its release note says “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
SecurityWeek counts this as the eighth Chrome zero-day exploited in 2026. The same update fixes a second XML use-after-free, CVE-2026-125346, which Arni Hardarson of Neonix Security reported on Oct. 12 and which Google did not flag as exploited. The other fixes are five High-rated bugs in WebGL, FileSystem, Compositing, GPU and V8, plus two Medium-rated GPU issues. Chrome for Android 157.0.8103.50 carries the same security fixes unless Google notes otherwise.
| Channel | Platform | Version with the fix |
|---|---|---|
| Stable | Windows, Mac | 157.0.8103.50 or .51 |
| Stable | Linux | 157.0.8103.50 |
| Stable | Android | 157.0.8103.50 |
| Extended Stable | Windows, Mac | 156.0.8078.96 |
Who is affected
Anyone running Chrome on Windows, macOS or Linux below the builds above is exposed, as are Android users who have not yet received 157.0.8103.50. Google is rolling the update out in stages, and Malwarebytes notes that people who rarely close their browser can fall behind. Hong Kong’s emergency response team, HKCERT, rates the overall risk of the update extremely high, according to Malwarebytes. SecurityWeek said CISA had not yet added the flaw to its Known Exploited Vulnerabilities catalog when it published on Nov. 10.
What to do
- Update Chrome now. Open About Google Chrome from the Settings or Help menu, let it download the update, and click Relaunch if prompted. Confirm the version is 157.0.8103.50 or later (steps per Malwarebytes).
- On Android, check Google Play for Chrome 157.0.8103.50.
- Managed fleets (our analysis): inventory Chrome versions, including Extended Stable, and use your management tools to push a relaunch so the fix takes effect.
- Other Chromium-based browsers (our analysis): Edge, Brave, Opera and Vivaldi take Chromium fixes on their own schedules, and we have not confirmed a fixed release for this CVE. Check each one for updates.
What we still do not know
- Who is exploiting the bug, whom they are targeting and how the exploit is delivered. Google has not said, and it keeps bug details restricted until most users have updated.
- What the exploit achieves. Google has not described the attack beyond saying one exists.
- Whether CISA will add the flaw to its Known Exploited Vulnerabilities catalog.
- Whether other Chromium-based browsers have shipped fixes yet.
Sources: Google Chrome Releases, Stable Channel Update for Desktop (Nov. 9, 2026); Chrome Releases, Extended Stable Update for Desktop (Nov. 9, 2026); Chrome Releases, Chrome for Android Update (Nov. 9, 2026); SecurityWeek (Nov. 10, 2026); Malwarebytes (Nov. 10, 2026).
Leave a Reply