🔍 Read the full analysis: An XML Bug Has Put Chrome In The Zero-Day Spotlight: Update Guide on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome updates on Nov. 9, 2026, fixing a high-severity XML use-after-free flaw, CVE-2026-125350, which the company says is being exploited in the wild. Users should check for the patched version and restart Chrome; other Chromium-based browsers need their own vendor updates.
Google released Chrome updates on Monday, Nov. 9, fixing a high-severity use-after-free flaw in the browser’s XML component that the company says is being exploited in the wild. The vulnerability, tracked as CVE-2026-125350, affects Chrome users who have not yet received and installed the patched release.
Google’s desktop security notes list nine security fixes in the update and say the XML flaw was reported by an anonymous researcher on Friday, Nov. 6. The company has rated it high severity. Google’s wording confirms that an exploit exists and is being used, but does not describe the attacks or identify those responsible.
The patched versions listed by Google are 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using Extended Stable on Windows and Mac should look for 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days.
To check Chrome on a computer, open the three-dot menu, choose Help, then About Google Chrome. The browser will check for an update; users must select Relaunch after it downloads for the update to take effect. On Android, check Chrome’s listing in Google Play and install the update if available. Google’s notes say Android releases carry the same security fixes as their corresponding desktop releases unless stated otherwise.
Chrome’s XML Bug In the Zero-Day Spotlight
Google says attackers are exploiting a high-severity Chrome flaw. Check for the update and restart Chrome to apply it.
What the flaw means
CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component.
Attack code is in use
Google confirms exploitation but has not described the attacks, targets, or who is responsible.
Install and relaunch
Check for the patched version and select Relaunch so the update takes effect.
Patched Chrome versions
Check the version for your platform; availability may vary during the staged rollout.
| Platform | Patched version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux | 157.0.8103.50 |
| Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update your browser
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Chrome in Google Play.
Apply it when available. Google says desktop updates may roll out over days or weeks.
Select Relaunch on desktop, then confirm the browser is running the patched version.
Other Chromium browsers
A Chrome patch does not update other browsers automatically.
- Edge: Microsoft said it was working on a security fix as of Nov. 10.
- Vivaldi and Brave: the source report described releases that included a fix or patched Chromium.
- Check your browser maker’s latest security notices.
- Confirm a fixed version is available before assuming you are protected.
Why the Exploited XML Flaw Matters
The immediate concern is that attack code is already in use, while the technical details remain restricted. Google has not said how attackers reach the flaw or what conditions are needed to exploit it, so users cannot use the available information to judge their individual exposure. Installing the patched version is the practical way to address the vulnerability once the update is available.
A use-after-free bug occurs when software uses memory after it has released that memory for reuse. Depending on how the flaw can be triggered and controlled, this class of error can cause crashes or data corruption and may allow code execution. Those are general risks associated with the bug type, not confirmed outcomes of attacks involving this particular Chrome flaw.
The update also matters beyond Chrome because several browsers use Chromium, the open-source project underlying Chrome. Google’s patch does not automatically update every Chromium-based browser: each vendor has to distribute its own release. Users of those browsers should check their maker’s security notices rather than assume the Chrome version has covered them.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and 12MP Center Stage Camera (2026, Silver)
FLEXISPOT Adjustable Workbench with Hand Crank, 47.2 x 23.6 Rubberwood Top
As an affiliate, we earn on qualifying purchases.
Chrome’s November Security Release
The Nov. 9 release also fixes a second XML use-after-free flaw, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on Oct. 12. Google’s release notes do not say that this second issue is being exploited. The two bugs share a broad technical category, but the confirmed in-the-wild exploitation statement applies to CVE-2026-125350.
According to a count of Google’s 2026 Chrome release notes in the source report, this is the eighth Chrome flaw this year for which Google has said it knows of exploitation in the wild. That is a count of flaws identified in those notices, not a measure of the number or scale of attacks. The source report says four of the eight were in Chrome’s V8 JavaScript engine.
Other browser makers had different update statuses as of Nov. 10. Microsoft said it was aware of exploits and was working on an Edge security fix, but had not listed a fixed version. Vivaldi’s desktop update was reported to include a fix, and Brave’s listed release was based on the patched Chromium version, though its release text did not name this CVE. The source report found no Opera desktop update mentioning the flaw at that time.
“Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.”
— Microsoft, Edge security release notes
Attack Details Remain Restricted
Google has not disclosed who is behind the attacks, who may have been targeted, or how the exploit works. Its release notes do not specify which part of Chrome’s XML handling is affected or describe the conditions needed to trigger the bug. The existence of exploitation is confirmed by Google; the scale, impact and targets are not established in the supplied material.
The update’s staged rollout also means that availability may vary by device and platform. As of Nov. 10, the source report found no Chrome for iOS or ChromeOS release note mentioning this flaw. It is not clear from that material whether separate updates for those platforms are planned or whether they are affected.
For other Chromium browsers, vendor status can change quickly. The release information cited here reflects what was published by the vendors or found in their notes on Nov. 10, not a guarantee of their current patch status.
Check for Patches Across Browsers
Chrome users should check their installed version and apply the listed update when it appears, then relaunch the browser. People managing work devices should follow their organization’s update process and confirm that the browser has restarted on a patched version. Google says its desktop rollout may take days or weeks, so a manual check can show whether an update is ready sooner.
Users of Edge, Vivaldi, Brave, Opera and other Chromium-based browsers should consult their browser maker’s release notes for a version that includes the fix. For Edge, the source report said Microsoft was still working on a fix on Nov. 10; for other vendors, readers should verify the latest status directly because release information may have changed. Google’s restricted technical details may be updated later, but the supplied release notes do not give a timetable for further disclosure.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit for it exists in the wild but has not publicly detailed how the exploit works.
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, Chrome 157 version 157.0.8103.50 for Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How do I install the Chrome update?
On desktop, open Chrome’s three-dot menu, select Help, then About Google Chrome. Install the update if prompted and click Relaunch. On Android, check Chrome in Google Play and update it if available.
Are other Chromium-based browsers patched?
Not automatically. Each browser maker distributes its own updates. Check the vendor’s release notes and confirm that a fixed version is available before assuming your browser is protected.
What is known about the attacks?
Google confirms that an exploit exists in the wild. The supplied information does not identify the attackers, targets, attack method or scale, and Google has restricted further technical details for now.
Source: ThorstenMeyerAI.com
