Chrome Zero-Day CVE-2026-125350: Google Confirms an Exploited XML Flaw, Fixed in Chrome 157.0.8103.50, and How to Check Every Device

Google released an emergency Chrome update on Monday, November 9, 2026, after confirming that attackers already have a working exploit for CVE-2026-125350, a use-after-free flaw in Chrome's XML component. Any company computer or phone still running an older Chrome is exposed to an attack that is already in use, through the browser your staff open for email, banking and cloud apps, so the fix needs to be on every device this week.

This follows the large Chrome 157 release we covered in Chrome 157 Security Update. That post was about the first Chrome 157 builds. This one is about a newer build that fixes a zero-day, and the earlier 157 builds do not include the fix.

What Google confirmed about the Chrome zero-day

In its Stable Channel Update for Desktop post on November 9, 2026, Google said:

• Chrome Stable moved to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out "over the coming days/weeks".
• The release has 9 security fixes: 7 rated High and 2 rated Medium.
• CVE-2026-125350 is rated High and described only as "Use after free in XML." It was reported anonymously on Friday, November 6, 2026, so Google shipped the fix three days later.
• Google's exact words: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."

The same release fixes a second XML flaw, CVE-2026-125346, also a use-after-free rated High. Arni Hardarson of Neonix Security reported it on October 12, 2026. Google has not said that one is being exploited.

In plain English, a "use after free" bug means the browser keeps using a piece of memory after it has handed that memory back. An attacker who can control what goes into that memory can sometimes get the browser to run their code. That is why browser vendors treat this kind of bug as serious.

What is not known yet

Google has published very little, and we will not fill the gaps with guesses:

• Who is using the exploit, and against whom. Google has not said.
• How it is delivered. Google has not said whether visiting a web page is enough, or whether this bug is one step in a longer attack chain.
• What an attacker gains. Google has not described the result of a successful attack.
• CISA listing. When we searched CISA's Known Exploited Vulnerabilities catalog for CVE-2026-125350 on November 10, 2026, there were no results. That can change quickly, and an exploit is confirmed whether CISA lists it or not.

Which Chrome versions fix CVE-2026-125350

One detail to watch: Google's earlier Android build, 157.0.8103.46 from November 5, matched the older 157.0.8103.38/.39 desktop builds. A phone that "already has Chrome 157" may still be on a build without this fix.

Microsoft Edge runs on Chromium, the same base as Chrome, but Microsoft's November 9 notice does not say which exploit it means. Treat Edge as still waiting for its fix until Microsoft publishes one. Other Chromium-based browsers ship their own builds on their own schedules, so check each vendor's release notes. Do not assume they are covered.

How to check Chrome is patched: this week's checklist

1. On each computer: open Chrome, go to Help, then About Google Chrome (or type chrome://settings/help). Let it download, then click Relaunch. The version must be 157.0.8103.50 or later.
2. On Android work phones: open Google Play, search for Chrome and tap Update. Then confirm the version in Chrome's Settings, under About Chrome.
3. On managed fleets: use your browser management console or endpoint tool to list Chrome versions by device, and chase anything below 157.0.8103.50.
4. Force the restart: Chrome's RelaunchNotification and RelaunchNotificationPeriod policies can require users to relaunch within a set time. A short deadline is reasonable this week.
5. Extended Stable machines: confirm they are on 156.0.8078.96.
6. Chromebooks: keep checking for a ChromeOS update and install it when Google releases one.
7. Edge: check edge://settings/help each day this week and install Microsoft's fix as soon as it ships.
8. Other Chromium browsers: if staff use Brave, Opera, Vivaldi or similar, check each vendor's release notes for this fix.

Why the restart is the step people miss

Chrome downloads updates quietly, but the fix only takes effect once the browser restarts. Many people leave Chrome open for days or weeks with dozens of tabs, so a laptop can have the patch sitting on disk while still running the vulnerable version. We wrote about that gap in Updated Is Not the Same as Patched. For this bug, count a device as patched only when the About page shows the fixed version after a relaunch.

Why a Chrome zero-day matters for a business

The browser is where most of your business actually happens: email, payroll, banking, Microsoft 365 or Google Workspace, your accounting system, and the admin panel for your website or online store. All of those signed-in sessions live in the browser. Google has not said what this particular exploit does. But memory-safety flaws in browsers are the kind of bug attackers use to get a foothold on a computer through web content, and one compromised staff laptop can expose every account that person is logged into. Stolen sessions get used fast, as we covered in Infostealer Attacks.

The browser also tends to fall through the cracks. Servers and firewalls usually have someone assigned to patch them, while browsers are left to auto-update and nobody checks the restart. If nobody in your company owns browser versions, this week is a good time to assign it.

Chrome zero-day CVE-2026-125350 questions people are asking

Is CVE-2026-125350 being exploited?

Yes. Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." It has not said who is using it or against whom.

What version of Chrome fixes CVE-2026-125350?

Chrome 157.0.8103.50 or .51 on Windows and Mac, 157.0.8103.50 on Linux and Android, and 156.0.8078.96 on Extended Stable.

Do I need to restart Chrome after updating?

Yes. The fix is not active until Chrome relaunches. Check the About Google Chrome page after the restart.

Is Chrome on Android affected?

Google says Chrome 157.0.8103.50 for Android contains the same security fixes as the matching desktop release. Update through Google Play.

Is Microsoft Edge affected by the Chrome zero-day?

Microsoft said on November 9 that it is aware of recent exploits in the wild and is working on a fix, but did not name a CVE. Watch for an Edge update and install it right away.

What is the Chrome XML component?

It is the part of Chrome that handles XML, a text format used for structured data on the web. Google lists the component only as "XML" and has given no further detail.

Is CVE-2026-125350 on CISA's KEV list?

It was not when we searched the catalog on November 10, 2026. Patch now anyway: Google has already confirmed exploitation.

The bigger lesson

An update that shows up in release notes protects nobody until it is running on every device. Businesses that keep a current list of their devices and can confirm browser versions in minutes handle a zero-day week calmly. Those that rely on auto-update and hope usually find the unpatched laptop after something has gone wrong. The work is simple: know what you run, make sure the restart happens, and assign someone to check.

If you want this kind of patch management handled for you, see security hardening or request a quote.

Get security alerts like this by email, plus the free checklist, at security alerts.

Sources: Google Chrome Releases: Stable Channel Update for Desktop, November 9, 2026; Google Chrome Releases: Chrome for Android Update, November 9, 2026; Microsoft: Release notes for Microsoft Edge Security Updates; CISA Known Exploited Vulnerabilities Catalog.