TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google released Chrome security updates on November 9, 2026, fixing CVE-2026-125350, a high-severity use-after-free bug in its XML component. Google says an exploit exists in the wild, but has not identified the attackers, targets or technical details. Check your browser vendor’s release notes and install the applicable update.
Google released Chrome updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. The company says an exploit for the bug exists in the wild, making the update relevant to users who may still be running an affected version.
Google’s desktop release notes list Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. Organizations using Extended Stable on Windows and Mac are directed to version 156.0.8078.96. Google says the desktop update will roll out over the coming days and weeks, while Android availability through Google Play may take a few days.
The bug was reported anonymously on November 6, according to Google, and the fix appeared three days later. Google describes the flaw as a “use after free in XML” and rates it High. A use-after-free occurs when software accesses memory after it has been released; depending on the circumstances, such bugs can cause crashes or allow more serious attacks. Google has not published enough technical detail to establish how this particular flaw is being used.
The same Chrome update fixes another XML use-after-free, CVE-2026-125346, which Google credits to researcher Arni Hardarson of Neonix Security. The release notes do not say that this second issue is being exploited. Google’s Android notes say releases carry the same security fixes as corresponding desktop releases unless otherwise stated.
Updates Across Chrome Platforms
Google’s statement that the flaw is being exploited means users should check for the update rather than assume it has already reached their device. On desktop, Chrome users can open the three-dot menu, select Help, then About Google Chrome. The page checks for updates; after one downloads, users need to select Relaunch to apply it.
People using other Chromium-based browsers should check their browser maker’s advisories. Google’s Chrome fix does not by itself confirm that a separate browser has received the same patch. As of November 10, Microsoft said it was working on an Edge fix, while Vivaldi reported a desktop update based on Chromium 156.0.8078.99 that includes a fix for this CVE. Brave’s listed release was based on Chromium 157.0.8103.50, though its release text did not name the CVE. The source report found no Opera desktop update mentioning the flaw at that time.
The source report counted this as the eighth Chrome flaw in 2026 for which Google’s release notes said an exploit existed in the wild. That count is based on the report’s review of Google’s posts; it does not identify who carried out the attacks or how many people were affected.
Products Worth Considering
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Samsung Galaxy Tab A11+ 11-Inch Tablet, 6GB RAM, 128GB Storage, Expandable, Gray
As an affiliate, we earn on qualifying purchases.
A Three-Day Fix Timeline
Google’s Chrome Stable Channel release notes say CVE-2026-125350 was reported on Friday, November 6. Google published the fixed release on Monday, November 9, and noted that distribution would continue over the coming days and weeks. The rollout schedule means users may see the update at different times.
XML is a format for structured data that browsers can encounter in documents and graphics such as SVG. Google has not specified which part of Chrome’s XML handling is affected. The source report says security publications including SecurityWeek, The Hacker News and BleepingComputer also reported the count of eight exploited Chrome flaws this year. Google’s own release notes are the basis for the vulnerability description, severity and affected versions cited here.
“Use after free in XML.”
— Google, in the release notes
Attack Details Remain Restricted
Google has not named the attackers, described who was targeted or explained how the exploit works. The number of affected users and whether the attacks were limited to particular organizations or regions are also unknown from the cited material. Google says the desktop rollout will take days or weeks, so availability may vary by device.
The source report found no Chrome for iOS or ChromeOS release note mentioning this flaw as of November 10. That does not establish whether those products are affected or when any relevant updates might appear. The status of vendors that had not published a fix or advisory was also unclear at the time of the report.
Check for Vendor Updates
Chrome users should check their installed version and apply the update listed for their platform, then relaunch the browser. Android users can check Google Play for an update and find the version number in Chrome’s Settings under About Chrome. Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should consult their vendor’s current security notes for a version that addresses the flaw.
Google’s staged rollout and further vendor notices are the next practical developments to watch. More information about the attack, its targets and the affected Chrome code may become available later, but the cited reports do not provide it as of November 10.
Key Questions
Which Chrome versions contain the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 version 157.0.8103.50 for Android. Extended Stable users on Windows and Mac are directed to 156.0.8078.96.
How can I check whether Chrome is updated?
On desktop, open Chrome’s three-dot menu and choose Help, then About Google Chrome. Install any offered update and select Relaunch. On Android, check Google Play for a Chrome update.
What does Google say about exploitation?
Google says an exploit for CVE-2026-125350 exists in the wild. It has not disclosed who is behind the attacks, who was targeted or how the exploit works.
Are other Chromium-based browsers covered by Chrome’s update?
Not automatically. Each browser vendor distributes its own updates. The source report said Vivaldi had announced a fix, Microsoft was working on one for Edge, and Brave listed a release using the fixed Chromium version but did not mention the CVE in its release text.
Source: Thorsten Meyer AI
