🔍 Read the full analysis: Attackers Are Exploiting A Chrome XML Bug: Find Your Update on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google’s November 9 Chrome update fixes CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit exists in the wild and is distributing fixes by platform; users should check for updates and restart Chrome. The attackers, targets and exploit method have not been disclosed.
Google released a Chrome security update on November 9 that fixes CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit for the flaw exists in the wild, meaning attackers are using it before all users may have received the patch; the company has not disclosed who is behind the activity or who has been targeted.
The fixed desktop versions are 157.0.8103.50 or .51 for Windows and Mac, and 157.0.8103.50 for Linux. Google’s release notes say the update will roll out over the coming days and weeks, so users should check Chrome manually rather than assume it has installed. Chrome must be relaunched after downloading an update for the fix to take effect.
For Android, Google lists Chrome 157 (157.0.8103.50), with availability through Google Play expected over the next few days. Organizations using the Extended Stable channel should look for version 156.0.8078.96 on Windows and Mac. Google says Android releases carry the same security fixes as their corresponding desktop releases unless stated otherwise.
The November 9 release includes nine security fixes. Google rates CVE-2026-125350 High and describes it as “Use after free in XML.” The same update fixes another XML use-after-free flaw, CVE-2026-125346, reported on October 12; Google has not said that second vulnerability is being exploited. The report says the newly patched flaw was reported by an anonymous researcher on November 6, three days before the fix shipped.
Chrome’s XML Bug Needs an Update
Google says attackers are exploiting a high-severity Chrome vulnerability. Check your browser version and relaunch Chrome after updating.
Who needs which version?
Google is distributing fixes by platform, so check the version for your device.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update, then relaunch
The fix takes effect after Chrome restarts.
On desktop, open Help, then About Google Chrome. On Android, check Chrome in Google Play.
Google’s rollout may take days or weeks, so check manually.
Select Relaunch after the update downloads to complete installation.
Other Chromium browsers
Google’s Chrome release does not automatically update other browsers.
- Vivaldi Desktop 8.3 listed a fix.
- Brave 1.99.56 used the matching Chromium version.
- Microsoft said it was working on an Edge fix.
- No Opera desktop update mentioning the flaw was reported.
What is confirmed?
The vulnerability is CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component.
Why the Active Exploit Matters
The warning that an exploit is being used in the wild makes this update more urgent than a routine browser patch. A use-after-free vulnerability occurs when software continues to use memory after it has been released. Depending on the circumstances, such bugs can cause crashes or data corruption and may allow more serious code execution. Those are general risks associated with the vulnerability class, not details Google has confirmed for this particular flaw.
Because Chrome updates arrive gradually, a device may remain exposed after Google has published the fix. Checking the installed version and restarting the browser can help users confirm that the update is active. The issue also matters beyond Chrome: other browsers based on Chromium need their vendors to ship compatible fixes, and Google’s release alone does not establish that every such browser is protected.
The source report counts this as the eighth Chrome vulnerability in 2026 for which Google has said an exploit exists in the wild. That count is based on Google’s release notes and is a tally of reported exploited flaws, not a measure of the number of attacks, victims or their severity.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
As an affiliate, we earn on qualifying purchases.
Patch Timeline and Browser Versions
Google’s release notes say CVE-2026-125350 was reported on November 6 and fixed in the stable release published November 9. The company’s wording confirms awareness of exploitation but does not describe when attacks began, how many users may be affected or whether they were aimed at particular organizations or individuals.
The source report checked several Chromium-based browser releases on November 10. It said Vivaldi Desktop 8.3 had moved to Chromium 156.0.8078.99 and explicitly listed a fix for the CVE. Brave’s release page listed version 1.99.56, based on Chromium 157.0.8103.50, though its release text did not name the vulnerability. Microsoft said it was aware of the exploits and working on a security fix, but no fixed Edge version was listed in the report. The report found no Opera desktop update mentioning the flaw at that time.
These details are a snapshot of vendor information available on November 10, not a guarantee of each browser’s current status. Chromium-based browsers rely on their own vendors to package and distribute updates. The source report also found no Chrome for iOS or ChromeOS release note mentioning the flaw as of that date.
“Use after free in XML.”
— Google, describing CVE-2026-125350
Attack Details Remain Restricted
Google has not publicly identified the attackers, targets or number of affected users. It has also not explained how the exploit works, whether successful exploitation requires particular user actions, or whether attacks are ongoing. The available information confirms exploitation, but not the scope or impact of the activity.
It is also not clear from the source material when every platform and Chromium-based browser will receive its patch. Google’s desktop and Android rollout windows extend beyond the release date, while other browser vendors may follow different schedules. No Chrome for iOS or ChromeOS release mentioning this vulnerability was identified in the report as of November 10; that does not establish whether or when fixes for those products will be issued.
Check for Vendor Patch Releases
Chrome users should open the browser menu and go to Help, then About Google Chrome. Chrome checks for an update on that page; if one is downloaded, select Relaunch to complete installation. Android users can check Chrome’s listing in Google Play and review the version under Chrome’s Settings. The relevant versions are 157.0.8103.50 or .51 on Windows and Mac, 157.0.8103.50 on Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should consult that browser’s own update page and release notes. The next practical milestones are vendor announcements and the arrival of fixed versions across platforms. Google has not announced further public technical details about the exploit, so the scope of the attacks remains open.
Key Questions
Which Chrome bug is Google fixing?
The update fixes CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild.
Which Chrome version should I install?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should look for 156.0.8078.96.
How do I check whether Chrome is updated?
On a computer, open Chrome’s three-dot menu, select Help, then About Google Chrome. Let the browser download any available update and choose Relaunch. On Android, check Chrome in Google Play.
Are other Chromium-based browsers covered by Google’s Chrome update?
Not automatically. Each browser vendor distributes its own releases. Check the vendor’s security notes and update status; the source report said Edge was still working on a fix as of November 10, while it listed fixes or a matching Chromium version for Vivaldi and Brave.
What is known about the attacks?
Google has confirmed that an exploit exists in the wild, but has not publicly said who is using it, who has been targeted, how the exploit works or how many users are affected.
Source: ThorstenMeyerAI.com
