TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google released Chrome updates on Nov. 9, 2026, fixing CVE-2026-125350, a high-severity use-after-free bug in its XML component. Google says an exploit exists in the wild; it has not disclosed who is behind the attacks, who has been targeted or how the exploit works.
Google released Chrome security updates on Nov. 9 that fix CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit for the flaw exists in the wild, meaning the company is aware of it being used, but has not disclosed who is behind the attacks or who may have been targeted.
Google’s release notes describe CVE-2026-125350 as a “use after free in XML” and rate it high severity. The bug was reported by an anonymous researcher on Friday, Nov. 6; Google published the fix three days later. The company has restricted technical details for now, limiting what is publicly known about how an exploit works or what conditions it requires.
Google lists fixed desktop versions as 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. Android’s listed version is Chrome 157 (157.0.8103.50). Businesses using the Extended Stable channel should look for 156.0.8078.96 for Windows and Mac. Google says desktop releases will roll out over the coming days or weeks, and the Android release will appear on Google Play over the next few days.
The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on Oct. 12. Google’s notes do not say that this second bug is being exploited. The release notes also do not identify an equivalent update for Chrome on iOS or ChromeOS as of Nov. 10.
Why the Exploit Notice Matters
Google’s statement that an exploit exists in the wild makes the release time-sensitive: the vulnerability was known to be used before the fix shipped. Users who have not restarted Chrome after an update may still be running an older version, while the update’s gradual rollout means it may not yet be offered on every device.
The flaw is in Chrome’s XML component. A use-after-free is a memory handling error in which software tries to use memory after releasing it. Such bugs can cause crashes or data corruption and, depending on the circumstances, may enable more serious outcomes. The Hacker News described those potential outcomes as including arbitrary code execution; Google has not published details showing what this particular exploit can do.
The issue also matters to people using browsers based on Chromium, the open-source project underlying Chrome. Those browsers depend on their own vendors to incorporate and distribute fixes. A Chrome update does not by itself update Edge, Brave, Opera or Vivaldi.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
As an affiliate, we earn on qualifying purchases.
A Three-Day Report-to-Fix Timeline
Google’s Chrome Releases notes say the XML bug was reported on Nov. 6 by an anonymous researcher and fixed in the stable release published Nov. 9. Google says updates roll out gradually, so the date of release does not mean every device received the patch at once.
Google’s release notes also mark the vulnerability as exploited in the wild. The source article’s review of Google’s 2026 release notes counted this as the eighth Chrome flaw this year for which Google had flagged known in-the-wild exploitation. That count is based on the release notes, not a measure of the number of attacks or affected users.
As of Nov. 10, the source article reported different update statuses among Chromium browser vendors. Microsoft said it was working on an Edge fix; Vivaldi said its desktop update included a fix; and Brave’s listed release used the same Chromium version as Google’s fixed release, though its release text did not name the CVE. The article found no Opera desktop update mentioning the flaw at that time.
““Google is aware that an exploit for CVE-2026-125350 exists in the wild.””
— Google Chrome Releases
What Google Has Not Disclosed
Google has not named the people behind the exploitation, described who was targeted or explained how the exploit works. It has also not said how widespread the activity is, whether attacks have succeeded, or what users would need to do to be exposed. The technical details remain restricted, and the available release notes do not answer those questions.
Browser coverage is also developing. The source article found no Chrome iOS or ChromeOS release note mentioning the flaw as of Nov. 10, and vendor update availability may change. It is not clear from the cited information when every Chromium-based browser will receive a fix.
Check for the Patched Release
On desktop, open Chrome’s three-dot menu and choose Help, then About Google Chrome. Chrome checks for an update there; if it downloads one, select Relaunch to finish applying it. Confirm the displayed version matches the release for your platform.
On Android, check Google Play for a Chrome update and review the version under Chrome Settings, About Chrome. If you use Edge, Brave, Vivaldi, Opera or another Chromium-based browser, check that browser maker’s release notes and update channel directly. Google’s Chrome rollout schedule and vendor releases may continue to change over the coming days.
Key Questions
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android Chrome 157 (157.0.8103.50). Extended Stable users on Windows and Mac should look for 156.0.8078.96.
Does Google say attackers are using the bug?
Yes. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild. It has not disclosed the attackers, targets or technical details.
How do I update Chrome on a computer?
Open the three-dot menu, go to Help, then About Google Chrome, and let Chrome check for an update. Click Relaunch if prompted so the update is applied.
Are other Chromium-based browsers covered automatically?
No. Each browser vendor must ship its own update. Check the release notes for your browser and confirm its installed version rather than assuming a Chrome update covers it.
Source: Thorsten Meyer AI
