🔍 Read the full analysis: Chrome’s XML Zero-Day: What’s Happening And Which Version To Get on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome security updates on November 9, 2026, fixing CVE-2026-125350, a high-severity XML use-after-free flaw that the company says is being exploited in the wild. Update to the fixed version for your platform and relaunch Chrome; attack details, targets and the attackers’ identity have not been disclosed.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit for the vulnerability exists in the wild, making it an active security issue for users who have not yet received and installed the fix.
For most desktop users, Google lists Chrome 157.0.8103.50 or .51 for Windows and Mac, and 157.0.8103.50 for Linux. The Android release is Chrome 157 (157.0.8103.50). Organizations using the Extended Stable channel should install 156.0.8078.96 on Windows and Mac. Google says desktop updates will roll out over the coming days or weeks, while the Android version is expected on Google Play over the next few days.
Google’s release notes describe the flaw as a “use after free in XML” and rate it high severity. Such a memory-management error occurs when software reuses memory after it has been released. The Hacker News reported that this class of bug can lead to outcomes including data corruption, crashes or arbitrary code execution; Google has not publicly described how this particular flaw can be exploited.
The same update fixes another XML use-after-free bug, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second flaw is being exploited. The zero-day was reported by an anonymous researcher on November 6, according to Google, and the fix followed three days later.
To check Chrome on a computer, open the three-dot menu, choose Help, then About Google Chrome. Chrome checks for updates there; after it downloads one, select Relaunch to apply it. Android users can check Google Play for an Update option and find the installed version under Chrome Settings, then About Chrome. A downloaded update does not take effect until the browser restarts.
Chrome’s XML Zero-Day What to update now
Google says a high-severity Chrome flaw is being exploited in the wild. Install the version for your platform and relaunch the browser.
Fixed versions by platform
Check your channel and platform; Extended Stable uses a different version.
| Platform or channel | Version to get |
|---|---|
| Windows and Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Install and verify the fix
A download alone is not enough: Chrome must restart to apply the update.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Google Play.
Verify it matches the fixed version for your platform and channel.
Select Relaunch on desktop so the downloaded update takes effect.
What is known—and what is not
Google describes CVE-2026-125350 as a high-severity “use after free in XML.”
- Google says an exploit exists in the wild.
- The flaw was reported on November 6; the fix followed on November 9.
- Desktop updates roll out over the coming days or weeks.
- Attackers, targets and the scale of attacks.
- How this specific flaw is exploited or its consequences.
- Whether iOS or ChromeOS is affected.
Other Chromium browsers need their own fixes
Updating Chrome does not update Edge, Brave, Vivaldi or Opera.
Check separately
Each browser vendor distributes its own release. Follow that vendor’s security notices and confirm your installed version.
Status can change
The cited Edge, Vivaldi, Brave and Opera information reflects reports available by November 10, not current confirmation.
Why the Active Chrome Flaw Matters
Google’s statement that the flaw is being exploited in the wild means this is not only a theoretical vulnerability or a routine bug fix. Users should check for the update rather than assume it has already arrived, especially because Google says distribution will take time. The available source material does not establish how widespread the attacks are or what consequences they have had.
The release also matters beyond Chrome itself. Browsers such as Edge, Brave, Vivaldi and Opera are based on Chromium, but each vendor must issue and distribute its own browser update. A fixed Chrome version does not automatically update another Chromium-based browser. Users and administrators should check the relevant vendor’s release notes and version status.
As of November 10, the supplied source reports that Microsoft said it was working on an Edge security fix, while Vivaldi had published a desktop update it said included the fix. Brave’s listed release was built on Chromium 157.0.8103.50, though its release text did not mention this CVE. The source found no Opera desktop update mentioning the flaw at that time. These are dated snapshots, not confirmation of each browser’s current status.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
As an affiliate, we earn on qualifying purchases.
Google’s November Security Release
The November 9 release covered nine security fixes, including the actively exploited XML issue and the second XML use-after-free. Google’s release notes say CVE-2026-125350 was reported on November 6 and that the fixed desktop versions would roll out over the coming days or weeks. Google has temporarily restricted further details about the flaw, a practice that limits public information while users and browser vendors receive fixes.
The supplied source counts CVE-2026-125350 as the eighth Chrome flaw in 2026 for which Google has said it is aware of exploitation in the wild. That count is based on Google’s Chrome release notes; the source says SecurityWeek, The Hacker News and BleepingComputer reported the same total. It is a count of disclosed exploited vulnerabilities, not a measure of attack volume or the number of people affected.
Google’s Android release notes say Android updates contain the same security fixes as their corresponding desktop releases unless otherwise specified. The source material says it found no Chrome for iOS or ChromeOS post mentioning this flaw as of November 10. That does not establish whether those platforms are affected or when an update will be published.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not disclosed who is behind the attacks, who may have been targeted, how many users or organizations were affected, or how the exploit works. The company has restricted technical details, so the public information does not establish the conditions needed to trigger the bug or the impact of any successful attack.
It is also not clear from the supplied information whether Chrome on iOS or ChromeOS is affected, or when updates for those platforms might be issued. The browser-vendor status can change quickly: the cited Edge, Vivaldi, Brave and Opera information reflects what had been published by November 10, not later releases. Users should confirm their installed version with their browser vendor.
Check for Fixes Across Browsers
Chrome users should check for the listed fixed version, install it and relaunch the browser. Android users should check Google Play as the release becomes available. People using Extended Stable should verify they have version 156.0.8078.96, rather than relying on the standard-channel version number.
Users of other Chromium-based browsers should monitor their vendor’s security notices and install that vendor’s release when available. Google’s rollout is continuing, and further details about the vulnerability or the attacks may emerge if Google or other affected vendors publish them. For now, the confirmed next step for users is to check their browser’s version and apply the appropriate update.
Key Questions
Which Chrome version fixes the XML zero-day?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should get 156.0.8078.96.
How do I install the Chrome update on a computer?
Open Chrome’s three-dot menu, select Help, then About Google Chrome. Let Chrome check for and download the update, then click Relaunch. The browser must restart for the update to take effect.
What does Google mean by “exploited in the wild”?
Google says an exploit for CVE-2026-125350 exists and is being used outside a controlled research setting. The company has not disclosed the attackers, targets, scale or technical method.
Are Edge and other Chromium browsers fixed by updating Chrome?
No. Each browser vendor distributes its own updates. Check the security notices and version information for your specific browser; a Chrome update does not automatically update Edge, Brave, Vivaldi or Opera.
Source: ThorstenMeyerAI.com
