🔍 Read the full analysis: Chrome’s Latest Zero-Day Has An XML Angle: Check Your Version on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9, 2026, fixing CVE-2026-125350, a high-severity use-after-free bug in the browser’s XML component. Google says an exploit exists in the wild; users should check that their browser has updated and restarted, while users of other Chromium-based browsers should check their vendor’s release notes.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says it is aware of an exploit for the vulnerability being used in the wild, making the update time-sensitive for Chrome users and organizations running the browser.
Google’s release notes describe the bug as “Use after free in XML” and rate it high severity. The company says the issue was reported by an anonymous researcher on November 6 and that an exploit exists in the wild. Google has not published technical details about how the exploit works, and its release notes do not identify the attackers or the people or organizations targeted.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. For organizations using the Extended Stable channel, Google lists 156.0.8078.96 for Windows and Mac. The desktop update is rolling out over the coming days or weeks, while the Android version is expected on Google Play over the next few days, according to Google.
The same release includes a second XML use-after-free flaw, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that CVE-2026-125346 is being exploited. The in-the-wild warning applies to CVE-2026-125350.
To check Chrome on a computer, open the three-dot menu, choose Help, then About Google Chrome. Chrome checks for updates there; after it downloads one, click Relaunch to apply it. On Android, check Chrome’s listing in Google Play for an Update button. A downloaded update does not take effect until the browser restarts.
Chrome’s XML flaw is under attack Check your browser update
Google says attackers are exploiting a high-severity flaw in Chrome’s XML component. Install the available update and restart Chrome to apply it.
What Google confirmed
The in-the-wild warning applies to CVE-2026-125350.
XML use-after-free
Google describes a high-severity memory bug in Chrome’s XML component.
Second XML flaw
CVE-2026-125346 is included in the release; Google’s notes do not say it is exploited.
Exploit details
Google has not named attackers or targets, or explained what the exploit can do.
Check the fixed release
Google says the rollout may take days or weeks on desktop.
| Platform or channel | Version listed by Google |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux and Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Apply the update
A download alone does not activate the fix.
On desktop, open the three-dot menu, choose Help, then About Google Chrome.
Let the update download, then click Relaunch to apply it.
Look for an Update button on Chrome’s Google Play listing.
Other Chromium browsers
Each vendor ships its own browser update.
- Vivaldi said its desktop update included the fix.
- Brave’s listed release used the fixed Chromium version.
- Microsoft said it was working on an Edge security fix.
- Check your browser vendor’s current security notes.
- Install that browser’s fixed release when available.
- Do not assume Chrome’s update patches another browser.
Why the XML Fix Needs Attention
The immediate concern is that Google says the flaw is already being exploited, but has not disclosed who is using it or the scale of the activity. A fix is available for Chrome, so checking the installed version and restarting the browser are practical steps users can take while the rollout continues.
The vulnerability is a use-after-free memory error: software releases memory and later tries to use it again. Such bugs can cause crashes or memory corruption and, depending on the specific flaw and exploit, may allow more serious outcomes. The available source material does not establish what attackers can achieve through this particular bug. Google has not described its exploit mechanics or the affected XML pathway, so broader conclusions about the risk would be premature.
The update also matters beyond Chrome itself. Browsers including Edge, Brave, Vivaldi and Opera are based on Chromium, but each vendor must ship and distribute its own browser update. A Chrome version number or update status does not confirm that another Chromium-based browser is patched.
Products Worth Considering
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
As an affiliate, we earn on qualifying purchases.
Three Days From Report to Fix
Google’s desktop release notes say an anonymous researcher reported CVE-2026-125350 on Friday, November 6, and Google published the fix on Monday, November 9. That is a short reported-to-release interval, although the public notes do not explain when Google confirmed exploitation or how long the vulnerability may have been exposed before the report.
According to the source article’s review of Google’s 2026 Chrome release notes, this is the eighth Chrome flaw this year for which Google has said an exploit exists in the wild. The same review says four of those eight involved V8, Chrome’s JavaScript engine. This count is a tally of Google’s public notices, not a measure of the number of attacks, victims or severity across the year.
Other Chromium vendors were at different stages as of November 10. Microsoft said it was aware of exploits and was working on an Edge security fix. Vivaldi said its desktop update included a fix for CVE-2026-125350. Brave’s listed release was based on the fixed Chromium version, though its release text did not name the CVE. The source article found no Opera desktop update mentioning the flaw at that time. Those vendor statuses can change as releases roll out.
““Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.””
— Microsoft, Edge security release notes, November 9
Exploit Details Remain Restricted
Google has not disclosed how the exploit works, which part of Chrome’s XML handling is affected, or what an attacker could accomplish. The company has also not identified those behind the attacks, any targets, or the number of users affected. Its statement confirms exploitation in the wild but does not quantify it.
It is also unclear when every user will receive the update, since Google says the desktop rollout may take days or weeks. The source article found no Chrome iOS or ChromeOS release note mentioning this flaw as of November 10; that does not by itself establish whether those platforms are affected or when a fix may be issued. Users of other Chromium browsers should rely on their own vendor’s current advisories rather than assume Chrome’s patch has reached them.
Check Updates Across Browsers
Chrome users should check the version available for their platform, install the update and restart the browser so the fix is active. Administrators should confirm that managed devices have received the relevant Stable or Extended Stable release, especially while Google’s rollout is still in progress.
Users of Edge and other Chromium-based browsers should watch their vendors’ security release notes for a fixed version and apply it when released. Google may publish more technical information as the rollout progresses, and vendors may post further platform-specific details. Until then, the known facts are limited to Google’s high-severity rating, its in-the-wild exploitation warning and the versions it lists as fixed.
Key Questions
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac on Extended Stable. Check Chrome’s About page for the version available to your installation.
How do I apply the Chrome update?
On desktop, open the three-dot menu, choose Help, then About Google Chrome. Let the update download and select Relaunch. On Android, check for an update in Google Play. Restarting is needed for a downloaded desktop update to take effect.
What does Google say about exploitation?
Google says it is aware of an exploit for CVE-2026-125350 in the wild. It has not publicly explained how the exploit works, identified attackers or named targets.
Does the Chrome fix automatically update Edge or Brave?
No. Chromium-based browsers have their own release processes. Check the browser vendor’s security notes and install that browser’s update; a Chrome update does not confirm that another browser is patched.
Source: ThorstenMeyerAI.com
