🔍 Read the full analysis: How To Respond To The XML Bug In Chrome’s Eighth Zero-Day on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9, 2026, fixing CVE-2026-125350, a high-severity XML use-after-free bug it says is being exploited in the wild. The fix is rolling out across listed desktop and Android versions; users should check for updates and restart Chrome. The attacker, targets and exploit details have not been disclosed.
Google released Chrome security updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google said it is aware that the vulnerability is being exploited in the wild, making prompt installation of the fixed version important for Chrome users.
Google’s release notes identify the flaw as a use after free in XML and rate it High. The bug was reported anonymously on November 6, according to Google, and the company published the fix three days later. Google has not described the attacks or disclosed how the exploit works.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using the Extended Stable channel on Windows and Mac are directed to version 156.0.8078.96. Google said desktop updates would roll out over the coming days or weeks and the Android release would appear on Google Play over the next few days.
On a computer, users can open Chrome’s three-dot menu, select Help, then About Google Chrome, and install any offered update. They must select Relaunch for the update to take effect. Android users can check Google Play for an update. Google’s release notes list nine security fixes in the desktop update, including a second XML use-after-free bug, CVE-2026-125346; Google did not say that second flaw was exploited.
Respond to Chrome’s XML Bug in Its Eighth Zero-Day
Google says CVE-2026-125350 is being exploited in the wild. Update Chrome and relaunch it; other Chromium-based browsers need their own vendor fixes.
What the bug means
The flaw is a use-after-free in Chrome’s XML component. Google has not explained how the exploit works.
Exploited in the wild
Google confirms an exploit exists, so users should not postpone the update.
Attack details withheld
Attackers, targets, scope and technical details have not been disclosed.
Install the Chrome fix
The update must be relaunched to take effect, and rollout may take days or weeks.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Google Play.
Install the offered update and select Relaunch. If no update appears yet, check again later.
Fixes vary by browser
Each Chromium-based browser vendor distributes its own updates.
| Browser or channel | Fix status in the source |
|---|---|
| Chrome desktop | 157.0.8103.50/.51 for Windows and Mac; 157.0.8103.50 for Linux |
| Chrome Android | 157.0.8103.50 |
| Extended Stable | 156.0.8078.96 for Windows and Mac |
| Other Chromium browsers | Check each vendor’s current security notices |
Why the XML flaw needs prompt attention
Google’s statement that an exploit is already being used in the wild means users should not treat this as a routine update to postpone. A use-after-free flaw occurs when software tries to use memory after it has been released. Depending on the circumstances, such flaws can cause crashes or data corruption and may permit more serious exploitation. Those are general risks of the bug class, not details Google has confirmed for this vulnerability.
The fix matters beyond Chrome because other browsers use Chromium, the open-source project on which Chrome is built. Those browsers do not necessarily receive Google’s fix at the same time: users need to check their own vendor’s release notes and update channel rather than assume that a Chrome update also protects them.
Products Worth Considering
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 256GB SSD, Liquid Retina Display, and 1080p Camera — Blush
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
How the fix reached Chrome users
The release followed a short reported timeline: an anonymous researcher reported CVE-2026-125350 on Friday, November 6, and Google published the fixed Chrome versions on Monday, November 9. Google’s warning about active exploitation appears in its release notes; the update also contains fixes for other security issues.
The source review of Google’s 2026 Chrome release notes counted this as the eighth Chrome flaw this year for which Google said it was aware of exploitation in the wild. That count is attributed to the source’s review of those notes, and other outlets named in the source material reported the same number. Four of the eight flaws were reported as involving V8, Chrome’s JavaScript engine; the current vulnerability is in the XML component.
As of November 10, vendor information for Chromium-based browsers varied. Microsoft said it was working on an Edge security fix but had not listed a fixed version. Vivaldi said its desktop update included a fix for CVE-2026-125350, while Brave’s listed release was built on Chromium 157.0.8103.50, the fixed Chrome base version, though its release text did not name the vulnerability. The source found no Opera desktop update mentioning the flaw at that time.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack details remain restricted
Google has not publicly identified who is behind the attacks, which users or organizations were targeted, how widespread the exploitation is, or how the exploit works. The company is keeping technical details restricted while the update rolls out. The source material also found no Google release-note post for Chrome on iOS or ChromeOS that mentioned this flaw as of November 10; that does not establish whether or when those products will receive a relevant update.
For browsers built on Chromium, the timing and availability of fixes depend on each vendor. The source material records vendor statuses as checked on November 10, so they may have changed since then. Users should rely on current notices from their browser maker.
Check for your browser’s fix
Chrome users should check their installed version now, apply the update if offered, and restart the browser to activate it. Because Google said rollout would take days or weeks, a user who does not yet see the update can check again later rather than assume the browser is protected.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should check that vendor’s security release notes for a version that addresses CVE-2026-125350. The next useful developments will be confirmation of fixed versions across those browsers and any further information Google releases about the vulnerability or its exploitation.
Key Questions
What is the Chrome XML zero-day?
CVE-2026-125350 is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild, but has not publicly explained how it works.
Which Chrome versions fix the vulnerability?
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and Extended Stable 156.0.8078.96 for Windows and Mac.
How do I install the Chrome update?
On desktop, open the three-dot menu, choose Help, then About Google Chrome. Install the update and click Relaunch. On Android, check Google Play for a Chrome update.
Does updating Chrome also fix Edge or other Chromium browsers?
No. Each browser vendor distributes its own updates. Check your browser maker’s release notes and install the version that includes a fix for CVE-2026-125350.
Who is being targeted, and how does the exploit work?
Google has not disclosed the attackers, targets, scope of exploitation or technical details of the exploit. Those points remain unknown in the source material available as of November 10, 2026.
Source: ThorstenMeyerAI.com
