Google's November 9 Chrome update fixes CVE-2026-125350, a use-after-free bug in Chrome's XML code that attackers are already exploiting, plus eight other high and medium flaws. Desktop Chrome 157.0.8103.50 for Windows, Mac and Linux carries the fix. Check your version and relaunch.
Update Chrome on every computer you use for work and relaunch it. Google’s November 9 desktop release, Chrome 157.0.8103.50, fixes a bug that attackers are already using. “Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the company says in its Stable Channel release notes. BleepingComputer counts it as the eighth Chrome zero-day exploited in attacks this year.
What Google fixed
The flaw is a use-after-free bug in the code Chrome uses to handle XML, rated High. An anonymous researcher reported it on November 6, and Google shipped the fix three days later. Use-after-free bugs are memory errors that attackers chain to run their own code, and in a browser the usual entry point is a web page you open. Google has not said who is exploiting it, how, or against whom. It keeps bug details restricted “until a majority of users are updated with a fix.”
The same release closes eight other flaws, nine security fixes in total, according to the notes:
- High: a second use-after-free in XML (CVE-2026-125346), a type confusion bug in the V8 JavaScript engine, a buffer overflow in compositing, an out-of-bounds write in the GPU code, incorrect authorization in FileSystem and an uninitialized resource in WebGL.
- Medium: two uninitialized resource bugs in the GPU code.
Only CVE-2026-125350 is marked as exploited.
How to check you are covered
Google is rolling the update out “over the coming days/weeks,” so don’t wait for it to arrive on its own. The fixed versions are:
| Platform | Fixed Chrome version |
|---|---|
| Windows | 157.0.8103.50 or .51 |
| Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
Open the Chrome menu, go to Help > About Google Chrome, let it download, then press Relaunch. Chrome restores your tabs. A downloaded update does nothing until the browser restarts, and a laptop that sleeps for weeks with Chrome open can sit on an old build. BleepingComputer reported the update was available immediately when it checked.
Eight zero-days by November means patching on a schedule
According to BleepingComputer’s tally, the earlier 2026 Chrome zero-days landed in February, March (two), April, June and September (two). That is a little under one a month, about the pace of 2025, when Google fixed eight exploited Chrome bugs. If your company runs Chrome on managed laptops, force a relaunch within 48 hours of a security release through your device management policy. If you run a small team without one, ask everyone to check About Google Chrome today. Google’s notes cover desktop Chrome only. Edge, Brave, Opera and other browsers built on Chromium get the fix when their makers ship it, so check those browsers’ own update pages too.