TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google released Chrome updates on Nov. 9 that fix CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit exists in the wild; the source counts it as the eighth Chrome flaw this year that Google has flagged as exploited.
Google released Chrome updates on Nov. 9 to fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that the company says is being exploited in the wild. The update covers desktop and Android versions, and the source counts the bug as the eighth Chrome flaw in 2026 for which Google has acknowledged in-the-wild exploitation.
Google’s desktop release notes identify the issue as “Use after free in XML” and say it was reported by an anonymous researcher on Nov. 6. Google published the fix three days later. The company says the desktop update will roll out over the coming days or weeks, so users may need to check manually rather than wait for it to appear automatically.
The listed fixed versions are 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Chrome 157 (157.0.8103.50) for Android. Organizations using Extended Stable on Windows or Mac are directed to version 156.0.8078.96. Google says the Android release will become available through Google Play over the next few days.
The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on Oct. 12. Google’s notes do not say that second bug is being exploited. To apply a downloaded desktop update, users must relaunch Chrome; on Android, they can check Google Play for an update.
Why the Active Exploit Matters
Google’s statement that an exploit exists in the wild means the issue is not only a theoretical weakness: Google says it is already being used. The company has not published enough technical detail to establish how the attacks work or what access they could provide, but use-after-free flaws can cause memory corruption and, in some cases, allow code execution, according to The Hacker News.
Prompt updating matters because the fix is available while the desktop rollout is still underway. The risk also reaches beyond Chrome users: other browsers built on Chromium depend on their own vendors to incorporate and ship the relevant fixes. A Chrome update alone does not establish that a separate Chromium-based browser is protected.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet with Bluetooth and Color Touchscreen
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 24GB Memory, 1TB SSD, Midnight
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
A Three-Day Report-to-Fix Timeline
Google’s Stable Channel Update for Desktop says the flaw was reported on Friday, Nov. 6, and the fixed release was published on Monday, Nov. 9. The update includes nine security fixes overall, according to the source material. Google’s wording about in-the-wild exploitation is the basis for describing this as a zero-day: the flaw was being exploited before a fix was available.
The source’s count of eight such Chrome flaws in 2026 comes from reviewing Google’s release notes and is also attributed there to reporting by SecurityWeek, The Hacker News and BleepingComputer. The count describes vulnerabilities Google flagged as exploited in the wild; it does not by itself establish the number of attacks, victims or their scale.
Vendor status varied as of Nov. 10. Microsoft said it was working on an Edge security fix and acknowledged recent exploits, but had not listed a fixed version in the cited notes. Vivaldi said its desktop update based on Chromium 156.0.8078.99 included a fix for CVE-2026-125350. Brave’s listed release v1.99.56 uses Chromium 157.0.8103.50, though its release text did not mention this CVE. The source found no Opera desktop post addressing the flaw at that time.
“Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.”
— Microsoft, Edge security release notes
Targets and Exploit Details Unknown
Google has not said who is behind the attacks, who may have been targeted or how the exploit works. It has restricted technical details for now. The available information does not establish the scale of exploitation, whether attacks were targeted or widespread, or what capabilities the exploit provides.
The cited release notes also did not identify an iOS or ChromeOS update for this flaw as of Nov. 10. That does not confirm those platforms are affected or unaffected. Users of those versions should follow updates from Google, while users of other Chromium browsers should consult their browser vendor’s release notes.
Check for Browser Updates
Chrome users should check whether the fixed version is available for their platform. On desktop, open Chrome’s menu, select Help, then About Google Chrome; install any offered update and relaunch the browser. Android users can check Google Play for Chrome’s update. Google says the rollout will continue over the coming days or weeks on desktop and the Android release will reach Google Play over the next few days.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should check their vendor’s release notes and install the vendor’s fix when available. As of Nov. 10, the source reported a Vivaldi fix and a Brave release using the fixed Chromium version, while Microsoft was still working on an Edge fix and no Opera post addressing the issue had been found.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit for it exists in the wild.
Which Chrome versions contain the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should use 156.0.8078.96.
How do I apply the Chrome update?
On desktop, open Chrome’s menu, go to Help, then About Google Chrome, and relaunch after the update downloads. On Android, check Google Play for a Chrome update.
Is this the eighth Chrome zero-day of 2026?
The source counts it as the eighth Chrome flaw this year that Google has flagged as exploited in the wild, based on Google’s release notes. That count does not indicate how many attacks or victims there were.
Are other Chromium-based browsers fixed?
Status differed by vendor as of Nov. 10. Vivaldi said its desktop update included a fix, and Brave listed a release based on the fixed Chromium version. Microsoft said it was working on an Edge fix; the cited source found no Opera post addressing the flaw.
Source: Thorsten Meyer AI
