🔍 Read the full analysis: Chrome Zero-Day News: Attackers Use An XML Bug, So Check Your Version on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9, 2026, fixing CVE-2026-125350, a high-severity XML use-after-free bug it says is being exploited in the wild. Updates are rolling out across desktop and Android; users should check their version and restart Chrome after installing the fix. Google has not disclosed who is behind the attacks, who has been targeted or how the exploit works.
Google released Chrome security updates on November 9 that fix a high-severity flaw in the browser’s XML component, after the company said an exploit was already being used in the wild. The bug, tracked as CVE-2026-125350, affects Chrome users who have not yet received and installed the patched version; Google says the rollout will continue over the coming days and weeks.
Google classified the vulnerability as “use after free in XML” and rated it high severity. The company’s release note says it is aware of an exploit for the flaw in the wild. That confirms Google has received information about active exploitation, but the note does not describe the attack method or identify affected victims. An anonymous researcher reported the bug on November 6, according to Google; the fix followed three days later.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. Organizations using Extended Stable on Windows or Mac are listed for version 156.0.8078.96. Google says the desktop update will roll out over the coming days and weeks, while the Android version is expected on Google Play over the next few days.
The same release fixes eight security issues, including a second XML use-after-free bug, CVE-2026-125346, reported in October. Google’s notes do not say that the second flaw is being exploited. The source report counts CVE-2026-125350 as the eighth Chrome flaw Google has flagged as exploited in the wild this year, based on the company’s 2026 release notes.
Chrome Zero-Day News Check your version
Google says attackers are exploiting a high-severity XML flaw. Check for the update and restart Chrome after it installs.
What the flaw means
CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component.
Exploitation in the wild
Google says an exploit exists, but has not described how it works.
Who is affected
Google has not identified attackers, targets, or the scope of attacks.
Fixed Chrome versions
The rollout is underway across desktop and Android.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux | 157.0.8103.50 |
| Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Install the update
On desktop, open the three-dot menu, choose Help, then About Google Chrome.
After the update downloads, select Relaunch to run the patched version.
Look for Chrome updates in Google Play and confirm the version in Chrome settings.
Other Chromium browsers
Each browser maker publishes its own fixes and update schedule.
- Edge
- Brave
- Vivaldi
- Opera
- Chrome’s patch does not automatically update other browsers.
- Follow the security notices for the browser you use.
Why the Chrome Update Needs Attention
The immediate concern is the stated active exploitation: users may be exposed before their browser has completed its update. Google’s gradual rollout means the fix may not appear for everyone at the same time. Checking Chrome manually and restarting after the update downloads can shorten the time a device remains on an unpatched version.
The issue also matters beyond Chrome itself. Other browsers based on Chromium do not necessarily receive Google’s patch at the same time; their makers must issue their own updates. The source report said Microsoft had acknowledged the exploits and was working on an Edge fix, while Vivaldi listed a release containing the fix and Brave had a release based on the patched Chromium version. Those vendor details were reported as of November 10 and may change. Users should check the update information from the maker of the browser they actually use.
Google’s report does not establish how widespread the attacks are or what an attacker could accomplish in this particular case. A use-after-free is a memory-management error; security researchers generally warn that this class of flaw can cause crashes or, in some circumstances, allow code execution. That general possibility should not be read as confirmation of the impact of this specific exploit.
Products Worth Considering
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 256GB SSD, Liquid Retina Display, and 1080p Camera — Blush
Apple Mac mini Desktop Computer with M6 Chip (2026)
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
As an affiliate, we earn on qualifying purchases.
How Google Reported the XML Flaw
Google’s November 9 Stable Channel update describes CVE-2026-125350 as a use-after-free error in XML. In this kind of defect, software may try to use memory after it has been released. XML is a structured-data format that browsers process in some content, but Google has not specified which part of Chrome’s XML handling is affected or what conditions an attack would require.
The researcher’s report was dated November 6, and Google published the fixed versions on November 9. The company’s wording that an exploit exists “in the wild” is its confirmation of exploitation; it has not publicly supplied technical details. The source report’s count of eight exploited Chrome flaws in 2026 is its tally of Google release-note statements, rather than a separate claim about the number of attacks or victims.
For desktop Chrome, users can open the three-dot menu, select Help, then “About Google Chrome” to view the version and prompt a check for updates. After Chrome downloads an update, select Relaunch so the patched browser is running. On Android, check for Chrome updates in Google Play; the version number is available in Chrome’s settings under About Chrome.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release note
Attack Details Remain Restricted
Google has not named the attackers, said who was targeted, or explained how the exploit works. It has not provided information on the number of attacks, their geographic scope, or whether they succeeded in compromising devices. The company is keeping technical details restricted for now, according to the source report.
It is also not clear from the available release notes when every user will receive the update. The source report found no Chrome release-note post mentioning this flaw for iOS or ChromeOS as of November 10; that does not establish whether those platforms are affected or when a related update might arrive. Status may also differ among Chromium-based browsers because each vendor publishes its own fixes.
Check for Updates and Vendor Notices
Chrome users should check the version shown in the browser’s About page and install the applicable fixed release when it is available. Restart Chrome after downloading the update; the browser must relaunch for the new version to take effect. Android users should check Google Play and confirm the installed version in Chrome settings.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should follow that browser maker’s security releases rather than relying on Chrome’s update schedule. Google’s desktop and Android rollouts were still in progress on November 10. Further vendor updates or Google disclosures may clarify platform coverage, the exploit’s technical details and the scope of the attacks.
Key Questions
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How do I install the Chrome update?
On a computer, open the three-dot menu, choose Help, then About Google Chrome. If an update downloads, select Relaunch. On Android, check Google Play for a Chrome update.
What does Google say about exploitation?
Google says it is aware of an exploit for CVE-2026-125350 in the wild. It has not publicly identified the attackers or targets or explained how the exploit works.
Does the Chrome fix automatically update other browsers?
No. Chromium-based browsers such as Edge, Brave, Vivaldi and Opera are updated by their own vendors. Check the security notices and version information for the browser you use.
Source: ThorstenMeyerAI.com
