Google released an emergency Chrome update on November 9, 2026 to fix CVE-2026-125350, a high-severity use-after-free bug in Chrome's XML code that attackers are already exploiting. It is the eighth Chrome zero-day used in real attacks this year. To be protected, update Chrome to version 157.0.8103.50 or .51 on Windows and Mac, or 157.0.8103.50 on Linux, then relaunch the browser. Microsoft says a fix for Edge is still being worked on.[1][4][7]
 | |
| CVE | CVE-2026-125350 |
|---|---|
| Severity | High (Google rating; no CVSS score yet) |
| Type | Use after free |
| Component | XML (Chrome's XML parser) |
| Reported | November 6, 2026, by an anonymous researcher |
| Fixed | November 9, 2026 |
| Fixed in | Chrome 157.0.8103.50/.51 (Windows, Mac), 157.0.8103.50 (Linux, Android), Extended Stable 156.0.8078.96 |
| Exploited | Yes, Google says an exploit "exists in the wild" |
| Zero-day count | 8th exploited Chrome bug of 2026 |
| Edge | Fix not out yet (Microsoft, Nov 9) |
What happened
On Monday, November 9, Google pushed Chrome 157.0.8103.50/.51 to the Stable channel for Windows and Mac and 157.0.8103.50 for Linux. The update has nine security fixes. In the release note, Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild", which is the company's usual wording for a zero-day that attackers found and used before a patch was ready.[1][5]
The bug was reported to Google by an anonymous researcher on November 6, so the fix arrived three days later.[1][6] Google has not said who is using it, who was targeted or how the attack is delivered. It also keeps the bug report locked: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix."[1][4] SecurityWeek noted on November 10 that no information about the attacks appears to be public yet.[6]
What the bug does
CVE-2026-125350 is a "use after free" flaw in the part of Chrome that reads XML data. BleepingComputer explains that the parser deletes an object from memory but keeps a pointer to it. If the browser later reads that freed memory, an attacker who has arranged the memory layout can use it to run their own code.[4] The Hacker News says bugs of this kind can lead to data corruption, crashes or arbitrary code execution.[5]
A second XML use-after-free, CVE-2026-125346, was fixed in the same update. It was reported by Arni Hardarson of Neonix Security on October 12 and is not marked as exploited.[1]
Which version fixes it
Google's release notes list the fixed builds by channel. The update "will roll out over the coming days/weeks", but BleepingComputer found it was available straight away when it checked on November 10.[1][4]
- Windows and Mac: 157.0.8103.50 or 157.0.8103.51.[1]
- Linux: 157.0.8103.50.[1]
- Extended Stable (mostly businesses on Windows and Mac): 156.0.8078.96, which lists CVE-2026-125350 among its 11 fixes.[2]
- Android: Chrome 157.0.8103.50, arriving on Google Play "over the next few days". Google says Android builds carry the same security fixes as the matching desktop release.[3]
Google's notes do not mention Chrome on iPhone or iPad, and the ChromeOS Stable notes posted so far this month do not list this CVE.[1][3]
Edge, Brave and other Chromium browsers
Most other big browsers are built on Chromium, the open-source code behind Chrome, so they share the bug until their makers ship the fix. The Hacker News advises users of Microsoft Edge, Brave, Opera and Vivaldi to apply the fixes "as and when they become available".[5]
Microsoft Edge: In its security release notes dated November 9, Microsoft says it "is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix." The latest Edge Stable listed there is version 157.0.4341.42 from November 5, which came out before the bug was even reported to Google.[7][1] Once the fix lands, restart Edge so it takes effect.
Brave: Brave posted Release build 1.99.56, based on Chromium 157.0.8103.50 (the fixed version), on its GitHub page early on November 10.[8]
We had not seen fixed builds from Opera or Vivaldi at the time of writing.
How to update Chrome
Chrome updates itself in the background, but it only switches to the new code when the browser restarts. If you keep Chrome open for days, you may still be running the vulnerable version even though the update has downloaded.[4][5]
- Click the three-dot menu at the top right.
- Go to Help and then About Google Chrome. Chrome checks for the update.
- When it finishes downloading, click Relaunch.
- Open the About page again and check the number starts with 157.0.8103.50 or higher.
On Android, open the Play Store, search for Chrome and tap Update if the button is there. As the rollout runs over several days, it may not show for everyone yet.[3]
If you look after company machines, the same rule applies to everyone on the Extended Stable channel: they need 156.0.8078.96.[2] This is the second urgent patch in a week for many IT teams, after the SSHole OpenSSH flaw on Linux servers, and iPhone owners also have the iOS 27.2.1 security update waiting.
Eight Chrome zero-days in 2026
With this bug, Google has now patched eight Chrome vulnerabilities this year that were used in attacks before or around the time of the fix. The Hacker News, BleepingComputer and SecurityWeek all list the same seven earlier CVEs.[4][5][6] Four of the eight sit in V8, the JavaScript and WebAssembly engine. CVE-2026-125350 is the first of the year in Chrome's XML code.[4][9]
BleepingComputer counts eight exploited Chrome zero-days in the whole of 2025 as well, many of them reported by Google's Threat Analysis Group, which tracks spyware attacks. With seven weeks of 2026 left, this year has already matched that total.[4]
The US Cybersecurity and Infrastructure Security Agency (CISA) has added each of the seven earlier bugs to its Known Exploited Vulnerabilities catalog, which gives federal agencies a deadline to patch. At the time of writing, CVE-2026-125350 is not on that list yet; the catalog was last updated on November 9.[9][6]
| Date (2026) | Event |
|---|---|
| November 5 | Microsoft releases Edge Stable 157.0.4341.42 (before the bug was reported)[7] |
| November 6 | Anonymous researcher reports the XML use-after-free to Google[1] |
| November 9 | Google ships Chrome 157.0.8103.50/.51 and Extended Stable 156.0.8078.96 and confirms an exploit in the wild[1][2] |
| November 9 | Chrome 157.0.8103.50 for Android starts rolling out on Google Play[3] |
| November 9 | Microsoft says it is working on an Edge fix[7] |
| November 10 | Brave posts Release 1.99.56 on Chromium 157.0.8103.50[8] |
| November 10 | Security press reports the eighth Chrome zero-day of 2026; not yet in CISA's KEV catalog[4][6] |
What to watch
- The Edge fix. Microsoft has promised one but given no date.[7]
- CISA listing. If the bug is added to the KEV catalog, US federal agencies get a fixed deadline to patch. For this year's earlier Chrome bugs it was two to three weeks.[9]
- Attack details. Google may open the bug report once most users are updated, which is when it usually becomes clear who was targeted.[1]
State-linked hacking has been in the news all week, from the French supermarket fridge attack blamed on Iran to the Linux server break-ins, but nothing so far links those campaigns to this Chrome bug.
Frequently asked questions
Is it safe to use Chrome right now?
Yes, once you are on 157.0.8103.50 or later (156.0.8078.96 on Extended Stable) and have relaunched the browser. Older versions are exposed to a bug Google says is being exploited.[1][2]
How do I know if my Chrome is updated?
Go to Menu, Help, About Google Chrome. If it says Chrome is up to date and shows 157.0.8103.50 or .51, you have the fix.[5]
Is Microsoft Edge affected?
Edge is built on Chromium, and Microsoft says it is "actively working on releasing a security fix". Restart Edge when an update appears.[7]
Who is exploiting CVE-2026-125350?
Google has not said, and no attack details have been published.[1][6]
How many Chrome zero-days have there been in 2026?
Eight, counting this one. The others are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491.[5][6]
References
- "Stable Channel Update for Desktop". Srinivas Sista, Google Chrome Releases. November 9, 2026.
- "Extended Stable Update for Desktop". Google Chrome Releases. November 9, 2026.
- "Chrome for Android Update". Google Chrome Releases. November 9, 2026.
- "Google patches eighth Chrome zero-day exploited in attacks this year". BleepingComputer. November 10, 2026.
- "Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026". The Hacker News. November 10, 2026.
- "Chrome Update Patches Exploited XML Zero-Day, Eighth This Year". Eduard Kovacs, SecurityWeek. November 10, 2026.
- "Release notes for Microsoft Edge Security Updates". Microsoft Learn. Entry dated November 9, 2026.
- "Release v1.99.56 (Chromium 157.0.8103.50)". Brave, GitHub. November 10, 2026.
- "Known Exploited Vulnerabilities Catalog". CISA. Checked November 10, 2026 (catalog dated November 9).