Chrome CVE-2026-125350: Exploited XML Zero-Day Fixed in Chrome 157.0.8103.50, and How to Check Every Device

Google has fixed a Chrome flaw that attackers are already using. The fix shipped on Monday, November 9, 2026, in Chrome 157.0.8103.50/.51. If your business runs Chrome on Windows, Mac or Linux, every computer needs that version and a browser restart this week. An update that has downloaded but not relaunched does not protect anyone.

We covered the main Chrome 157 release in Chrome 157 Security Update: 213 Fixes, Seven Rated Critical. This post covers the follow-up release that came after it, and the one fix in it that matters more than the rest.

What Google confirmed about CVE-2026-125350

Google's Chrome Releases post for November 9, 2026, confirms the following:

• The Stable channel was updated to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, which Google says "will roll out over the coming days/weeks."
• The update has nine security fixes: seven rated High and two rated Medium.
• CVE-2026-125350 is rated High and described as "Use after free in XML." An anonymous researcher reported it on November 6, 2026.
• Google states: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."

That last sentence is what turns this from a routine update into a zero-day fix. It means Google knows working attack code for this flaw exists outside its own labs. It does not mean every Chrome user has been attacked.

In plain terms, a "use after free" bug happens when a program keeps using a piece of memory after it has already released it. Attackers can sometimes put their own data in that memory and steer the program into running it. This one is in the part of Chrome that processes XML, a common data format used by websites. The same update also fixes a second XML use after free, CVE-2026-125346, which a researcher reported in October. Google does not say that one has been exploited.

Google shipped the fix three days after the report came in. That pace tells you how seriously Google takes it.

What is not known yet

This is just as important as what is confirmed:

• Who is using it, and against whom. Google has not said who is exploiting the flaw, which industries or countries are being hit, or how many people are affected.
• How a victim is reached. Google has not published the bug details. It has not said whether simply visiting a web page is enough, or whether the exploit is paired with a second flaw to get out of Chrome's sandbox.
• Public tracking. When we checked on November 10, we found no published CVE record, and a search of CISA's Known Exploited Vulnerabilities catalog returned no result for this CVE. That may change soon.
• Microsoft Edge. On November 9, Microsoft added an entry to its Edge security release notes: "Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix." The entry names no CVE, so we cannot confirm it refers to this flaw. The latest Edge Stable release listed there is 157.0.4341.42, dated November 5, which is before Google's fix.

Which Chrome version fixes CVE-2026-125350

Google's posts that we read do not mention Chrome for iPhone or iPad for this fix, so we cannot say whether iOS is affected.

How to check your Chrome version

1. Open Chrome and go to the menu (three dots), then Help, then About Google Chrome. You can also type chrome://settings/help in the address bar.
2. Chrome will check for updates and download the latest version.
3. Click Relaunch. Until you relaunch, the old, vulnerable version is still running.
4. Confirm the version shows 157.0.8103.50 or higher (or 156.0.8078.96 or higher if your company uses Extended Stable).

On Android, open the Google Play Store, search for Chrome, and tap Update if it appears. Google says the Android build will reach Google Play "over the next few days," so it may not show up right away.

What to do this week

• Update Chrome on every Windows, Mac and Linux computer to 157.0.8103.50 or later, and make sure each one relaunches.
• If you manage Chrome centrally, check your management console for devices still on older builds, and set a relaunch deadline so staff cannot put off the restart for days.
• If you pin Chrome to Extended Stable, confirm devices are on 156.0.8078.96 or later.
• Update Chrome on company Android phones once 157.0.8103.50 appears in Google Play.
• Watch for Microsoft's Edge security fix and install it as soon as it ships. Until then, keep Edge itself up to date.
• On Chromebooks, watch for the next ChromeOS Stable update and install it.
• Check other Chromium-based browsers your staff use (Brave, Opera, Vivaldi and others) for updates that mention this fix.

Why a browser flaw matters to a business network

For most businesses, the browser is where the work happens: email, banking, payroll, the website admin panel, the cloud console and customer records. A browser that is taken over can expose the logged-in sessions to all of those. As we covered in Infostealer Attacks: Stolen Credentials Used an Average of 8 Minutes After Infection, stolen access gets used fast.

The weak point is rarely the patch itself. It is the gap between Google releasing a fix and every machine actually running it. A staff laptop that has not been restarted in two weeks is still on the old version, even though it shows a pending update. We wrote about that gap in Updated Is Not the Same as Patched, and it applies here exactly.

Chrome zero-day questions people are asking

Is CVE-2026-125350 being exploited?

Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." It has not said who is using it or who has been targeted.

What Chrome version fixes CVE-2026-125350?

Chrome 157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux, and Extended Stable 156.0.8078.96 on Windows and Mac.

Do I need to restart Chrome after updating?

Yes. Chrome downloads updates in the background, but the fix only takes effect after you click Relaunch or close and reopen the browser.

Is Microsoft Edge affected by the Chrome zero-day?

Not confirmed. Microsoft says it is aware of exploits in the wild and is working on a fix, but its note does not name this CVE.

Does this affect Chrome on Android or iPhone?

Google says the Android release 157.0.8103.50 carries the same security fixes as desktop. The posts we read say nothing about iPhone or iPad.

What is a use after free in XML?

It is a memory bug in the part of Chrome that reads XML data. The browser keeps using memory it has already released, which attackers can sometimes abuse to run their own code.

How do I check if Chrome is up to date?

Go to chrome://settings/help. Chrome checks for updates, shows your version, and offers a Relaunch button if an update is waiting.

The bigger lesson

Google went from report to fix in three days. Most businesses take much longer than that to get the fix running on every machine. The number that matters is not when Google shipped the patch. It is how many of your devices are still running the old version today, and whether anyone is checking.

If you want help keeping browsers, servers and websites patched, see security hardening or request a quote.

Get security alerts like this one by email, along with our free checklist, at security alerts.

Sources: Google Chrome Releases: Stable Channel Update for Desktop, November 9, 2026; Google Chrome Releases: Extended Stable Update for Desktop; Google Chrome Releases: Chrome for Android Update; Microsoft Edge security release notes.