Chrome CVE-2026-125350 zero-day: update to 157.0.8103.50

What happened

Google released a Chrome Stable update on Monday, November 9, 2026, with nine security fixes. One of them, CVE-2026-125350, is being exploited in the wild (Malwarebytes, The Register).

• The flaw: a high-severity use-after-free in Chrome’s XML component. The Hacker News reports a CVSS score of 8.8 and quotes the CVE.org description: a remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page, in Chrome prior to 157.0.8103.50 (The Hacker News).
• Discovery: an anonymous researcher reported it on November 6, 2026 (The Hacker News, Security Affairs).
• Exploitation: Google said it is “aware that an exploit for CVE-2026-125350 exists in the wild” (BleepingComputer). Google has not named the attackers, the targets, the delivery method, or what the exploit does (Malwarebytes). Further bug details may stay restricted until most users have updated (BleepingComputer).
• CISA: it added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-10 (CISA). The catalog entry sets a due date of 2026-11-24, lists ransomware use as “Unknown”, and says forensic triage under BOD 26-04 is not required (CISA KEV catalog).
• Year tally: this is the eighth actively exploited Chrome zero-day of 2026. The Register notes this equals the 2025 total (The Register).
• A second XML bug: the same release fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security in October. Google has not indicated that it is exploited (The Register).
• Where outlets differ: Security Affairs’ summary line calls CVE-2026-125350 a V8 vulnerability, but its body and every other outlet describe it as an XML use-after-free. This advisory follows the XML description.

Am I affected?

You are affected if you run desktop Chrome older than 157.0.8103.50 on Windows, macOS or Linux.

• Fixed desktop versions: 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux (The Hacker News, BleepingComputer).
• Android: Malwarebytes reports Chrome 157.0.8103.50 for Android was also released on November 9, with the same security fixes as desktop unless otherwise noted (Malwarebytes).
• Rollout: the update may take days or weeks to reach all users. BleepingComputer found it available immediately when it checked (BleepingComputer).
• Other Chromium browsers: CISA’s catalog entry says the flaw could affect multiple Chromium-based browsers, including Google Chrome, Microsoft Edge, and Opera (CISA KEV catalog). The Hacker News lists Edge, Brave, Opera and Vivaldi as browsers whose users should apply fixes when available (The Hacker News). Fixed versions for those browsers are not confirmed in the sources.
• Rating: Malwarebytes reports that Hong Kong’s HKCERT rates the overall risk of the update as “Extremely High” (Malwarebytes).

What to do now

1. Open Chrome, go to More > Help > About Google Chrome, let it download the update, and select Relaunch (The Hacker News). Chrome only applies the fix after a restart. Malwarebytes notes that browsers left open for long periods, or blocked by something like an extension, can lag behind (Malwarebytes).
2. Confirm the version is 157.0.8103.50 or later (157.0.8103.51 on Windows and macOS is also fixed).
3. On Android, check Google Play for Chrome 157.0.8103.50 (Malwarebytes).
4. If you manage other Chromium-based browsers such as Edge, Brave, Opera or Vivaldi, apply their updates as the vendors publish them (The Hacker News).
5. US federal agencies must apply the patch by November 24, 2026. CISA encourages all organizations to prioritize remediation of KEV catalog vulnerabilities (CISA).

No indicators of compromise or workarounds are published in the sources. They are not confirmed.

Update, 11 November 2026

• The Register says the same Chrome release also fixes eight other security vulnerabilities, including high-severity flaws affecting WebGL, FileSystem, GPU, Compositing, and the V8 JavaScript engine. (theregister.com)
• BleepingComputer lists the seven earlier Chrome zero-days exploited in 2026 as CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-87491 and CVE-2026-85046. (bleepingcomputer.com)

Sources

• The Hacker News: Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
• BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year
• Security Affairs: Google fixes the eighth actively exploited Chrome zero-day of 2026
• Malwarebytes: Update Chrome now to fix a flaw attackers are exploiting
• The Register: Chrome zero-day whack-a-mole continues as 2026 tally hits 8
• CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog
• CISA: Known Exploited Vulnerabilities Catalog