🔍 Read the full analysis: Chrome’s Eighth Zero-Day: XML Bug Raises An Update Question on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9, 2026, including a fix for CVE-2026-125350, a high-severity XML use-after-free flaw that Google says is being exploited. It is the eighth Chrome vulnerability this year that Google has flagged as exploited in the wild. The company has not disclosed who is behind the attacks, who was targeted or how the exploit works.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit for the flaw exists in the wild, making it the eighth Chrome vulnerability this year that the company has identified as actively exploited.
Google’s desktop update includes nine security fixes. The affected flaw was reported by an anonymous researcher on Friday, November 6, according to Google’s release notes, and the fix was published three days later. Google lists Chrome versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The Extended Stable release for Windows and Mac is 156.0.8078.96.
Google also released Chrome 157 for Android, with version 157.0.8103.50 listed for the security fix. The company says desktop updates will roll out over the coming days or weeks, while the Android version is expected to become available through Google Play over the next few days. The timing means some users may need to check for the update rather than assume it has already installed.
The same release fixes a second XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s published notes do not say that this second flaw is being exploited. The company rates CVE-2026-125350 as high severity and has restricted technical details while the security issue remains active.
Chrome’s XML flaw is exploited Check for the update
Google says attackers are exploiting a high-severity Chrome vulnerability. Updates are rolling out gradually, so install the fix when available and restart your browser.
What Google confirmed
The count measures vulnerabilities Google flagged as exploited, not attack campaigns or affected people.
CVE-2026-125350
A use-after-free flaw in Chrome’s XML component. Google says an exploit exists in the wild.
Second XML flaw
The release also fixes CVE-2026-125346. Google’s notes do not say it is being exploited.
Check your browser
Use the version for your platform and restart after installing.
| Platform | Fixed version listed |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Take these steps
A downloaded update only protects you after the browser restarts.
Open Help, then About Google Chrome, or check Chrome in Google Play on Android.
Apply the update and restart Chrome so the patched version is running.
Edge, Brave, Vivaldi and Opera distribute their own fixes. Check your vendor’s security notices.
What remains unknown
Google has restricted technical details while the issue remains active.
- Google says the flaw is being exploited.
- The desktop rollout may take days or weeks.
- Who is behind the attacks or who was targeted.
- How the exploit works or its impact on victims.
Why the Chrome Fix Needs Prompt Attention
The immediate concern is that Google says attackers are already exploiting the XML flaw, while the Chrome fix is rolling out gradually. Updating and restarting the browser reduces the time a device remains exposed to the known vulnerability. Chrome’s About page can check for an available update; on Android, users can check Chrome in Google Play. A downloaded update does not take effect until the browser is restarted.
The issue also reaches beyond Chrome itself. Browsers built on Chromium—including Edge, Brave, Vivaldi and Opera—depend on their own vendors to integrate and distribute security fixes. Google’s Chrome release alone does not confirm that another Chromium-based browser is protected. As of November 10, Microsoft said it was working on an Edge fix; Vivaldi said a desktop update included the fix; and Brave listed a release built on the fixed Chromium version. Opera had not published an update mentioning the flaw in the source material.
The annual count provides a measure of how often Google has publicly flagged Chrome flaws as exploited, but it does not describe the scale or impact of attacks. The figure is eight vulnerabilities in 2026 based on Google’s release notes, not eight known campaigns or a measure of how many people were affected.
Products Worth Considering
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
DJI Osmo Action 4 Essential Combo Waterproof 4K Action Camera
As an affiliate, we earn on qualifying purchases.
How Google Identified the Flaw
Google describes CVE-2026-125350 as a use after free in XML. In this class of memory-safety bug, software may try to use memory after it has been released. Depending on how the error can be triggered and controlled, such flaws can cause crashes or other security consequences. Google has not published enough technical detail to establish how this particular vulnerability is exploited.
Chrome processes XML in browser features and content, but Google has not identified the affected part of its XML handling. The Hacker News reported that use-after-free bugs can lead to outcomes including data corruption, crashes or arbitrary code execution; that is general context about the bug class, not confirmation of what attackers can achieve with this flaw.
The designation “in the wild” is based on Google’s statement that it is aware of an exploit for CVE-2026-125350. The source article’s count of eight comes from Google Chrome Releases posts for 2026. The seven earlier vulnerabilities listed there are CVE-2026-2441; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281; CVE-2026-11645; and CVE-2026-85046 and CVE-2026-87491.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not disclosed who is behind the exploitation, which users or organizations were targeted, how many attacks have occurred or how the exploit works. The company is withholding technical details for now. Its statement confirms exploitation but does not establish the attackers’ capabilities or the impact on victims.
It is also not clear from the available release notes when every eligible Chrome installation will receive the update. The stated rollout is spread over days or weeks on desktop. The source material reports no Chrome release note for iOS or ChromeOS that mentions this flaw as of November 10, so users of those platforms should look for platform-specific announcements rather than assume they are covered.
For other Chromium-based browsers, patch status depends on each vendor’s release. The vendor updates listed as of November 10 do not establish the current status of every browser version or managed workplace installation.
Check Browser Versions and Vendor Notes
Chrome users can open the three-dot menu, select Help, then About Google Chrome, and install the update if it is offered. They should relaunch Chrome after installation so the patched version is running. Android users can check for Chrome in Google Play and confirm the version under Chrome’s Settings and About Chrome.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should check their vendor’s security notices for a release that includes the fix. Google’s Chrome version numbers are not a substitute for the separate version and update process used by those browsers. Organizations using Extended Stable should check for version 156.0.8078.96 on Windows and Mac.
Further details may emerge as vendors publish patches and Google updates its advisories. Until then, the confirmed next step is to install the applicable vendor update and restart the browser; the scope and methods of the reported exploitation remain undisclosed.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild but has not publicly explained the affected code path or how the exploit works.
Which Chrome versions contain the fix?
Google lists versions 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Chrome 157 (157.0.8103.50) for Android. Extended Stable for Windows and Mac is listed as 156.0.8078.96.
Why is this called Chrome’s eighth zero-day of 2026?
Google has flagged eight Chrome vulnerabilities this year as exploited in the wild, based on its 2026 Chrome release notes. The count refers to vulnerabilities, not confirmed attack campaigns or affected users.
Does updating Chrome also fix other Chromium browsers?
No. Each browser vendor distributes its own updates. Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should check their vendor’s release notes for a version containing the fix.
Who is being targeted, and how does the exploit work?
Google has not disclosed who is behind the attacks, who was targeted or how the exploit works. The company says it is restricting technical details while the issue is active.
Source: ThorstenMeyerAI.com
