🔍 Read the full analysis: Chrome Has Another 2026 Zero-Day: What The XML Bug Means For Users on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome updates on November 9, 2026, fixing CVE-2026-125350, a high-severity XML use-after-free vulnerability that the company says is being exploited. Google has not disclosed who is behind the attacks, who was targeted or how they work; users should check for and install the version for their platform.
Google released Chrome updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that the company says is being exploited in the wild. The disclosure means attackers are using an exploit before all users have installed a fix, making it important to check for the update and restart Chrome after it installs.
Google’s Chrome release notes describe the vulnerability as a “Use after free in XML” and rate it High. The company’s statement that an exploit “exists in the wild” confirms active exploitation, but Google has not published technical details about the attack or its targets. An anonymous researcher reported the flaw on November 6, according to Google; the fix followed three days later.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using Extended Stable on Windows and Mac should use version 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days.
To check on a computer, open Chrome’s three-dot menu, select Help, then About Google Chrome. If an update downloads, click Relaunch; the browser must restart to apply it. On Android, check Google Play for an Update option and confirm the version under Chrome’s settings. The same release also fixes another XML use-after-free, CVE-2026-125346, but Google has not said that vulnerability is being exploited.
Chrome’s 2026 XML zero-day What users need to do
Google says attackers are exploiting a high-severity Chrome flaw. Install the update for your platform and restart Chrome to apply it.
What the flaw means
CVE-2026-125350 is a high-severity use-after-free in Chrome’s XML component. Google confirms exploitation but has not described the attack’s effects.
Exploitation is underway
Google says an exploit exists in the wild; the attackers and targets are undisclosed.
Impact details remain private
Google has not said what this specific exploit can do or how many devices may be affected.
Another XML flaw was fixed
The same release fixes CVE-2026-125346; Google has not said it is being exploited.
Check and install your update
The fix is rolling out over days or weeks on desktop, with Android availability expected over the next few days.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Google Play.
Apply the available update and click Relaunch on desktop so the fix takes effect.
Google lists version 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and Extended Stable 156.0.8078.96 for Windows and Mac.
Other Chromium browsers need their own fixes
A Chrome update does not update other browsers. Check the browser maker’s current security notices.
| Browser | Status reported by Nov 10 |
|---|---|
| Vivaldi | Desktop update reported with a fix |
| Brave | Release reported on patched Chromium; CVE not named in release text |
| Microsoft Edge | Exploit acknowledged; no fixed version listed yet |
| Opera | No desktop update mentioning the flaw found |
Why the Exploited XML Bug Matters
A flaw described as a use-after-free is a memory-management error: software may try to use memory after it has been released. Depending on the circumstances, such bugs can cause crashes or data corruption and may allow more serious behavior. The Hacker News said vulnerabilities of this type can lead to arbitrary code execution, but Google has not said what this particular exploit can do. That distinction matters: the bug is confirmed as exploited, while its effects in these attacks remain undisclosed.
The practical concern is the gap between the release of a fix and its installation across users’ devices. Google says its rollout will take days or weeks, so a fixed version may not yet be available to everyone through automatic updates. A manual version check can show whether the patch has arrived; restarting is needed to activate it. The source’s review of Google’s 2026 release notes counts this as the eighth Chrome flaw for which Google has reported in-the-wild exploitation this year. That count provides context for the update, but does not establish how widespread or severe the current attacks are.
The issue may also reach users of other Chromium-based browsers, but a Chrome fix does not automatically update those products. Each browser maker has to ship its own release. Users of Edge, Brave, Vivaldi, Opera and other Chromium browsers should check their vendor’s security notices rather than assume Chrome’s version or update schedule applies to them.
Popular right now
Dyson V15 Detect Cordless Vacuum
Breville Barista Touch Impress Espresso Machine, Noir (BES881NRE)
Shark NV752 Rotator Powered Lift-Away TruePet Upright Vacuum, Bordeaux
As an affiliate, we earn on qualifying purchases.
From Friday Report to Monday Fix
Google’s release notes say an anonymous researcher reported CVE-2026-125350 on Friday, November 6, and the company published the patched Chrome release on Monday, November 9. The timing is unusually direct in the available account: Google’s confirmation that an exploit exists accompanied the security update, rather than arriving after a period in which the flaw was known only as a theoretical risk.
XML is a format for structured data that browsers process in some settings, including XML documents and SVG graphics. Google has not identified which part of Chrome’s XML handling is affected. The source material reports that Vivaldi’s desktop update moved to Chromium 156.0.8078.99 and says it includes a fix for this CVE. It also reports that Microsoft had acknowledged the exploit but had not yet listed a fixed Edge version on November 10. Brave’s release page listed version 1.99.56, built on patched Chromium 157.0.8103.50, although its release text did not name the CVE; the source found no Opera desktop update mentioning it at that time.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google Chrome security release notes
Attack Details Remain Restricted
Google has not identified who is behind the attacks, which users or organizations were targeted, how many devices may be affected, or how the exploit works. It has also not described what the exploit accomplishes in practice. The existence of an in-the-wild exploit is confirmed by Google; claims about its reach or consequences cannot be established from the release notes provided.
As of November 10, the source material found no Google release note for Chrome on iOS or ChromeOS that mentioned this flaw. It also reported no Opera desktop update addressing it and no fixed Edge version listed by Microsoft. These are observations made at that time, not confirmation that those products are vulnerable or that no later updates exist. Browser makers’ release status can change, and users should consult the relevant vendor’s current notices.
Check for Browser-Specific Patches
Chrome’s desktop update is due to continue rolling out, and Google said Android availability on Google Play would follow over the next few days. Users should check Chrome’s About page or the Play Store, install the version listed for their platform, and relaunch the browser. For managed devices, administrators can confirm deployment against Google’s listed version numbers.
People using another Chromium-based browser should look for that browser maker’s own security release and verify the installed version. The next useful public developments would be vendor notices confirming patched versions and any further information Google chooses to release about the vulnerability or its exploitation. Until then, the scale, targets and mechanics of the attacks remain unknown.
Key Questions
What is the Chrome zero-day in this update?
CVE-2026-125350 is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild, but has not described how it works.
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and Extended Stable 156.0.8078.96 for Windows and Mac.
How do I apply the Chrome update?
On desktop, open the three-dot menu, choose Help, then About Google Chrome. Install the update and click Relaunch. On Android, check Google Play for a Chrome update.
Are other Chromium-based browsers patched?
Not necessarily. Each browser maker distributes its own updates. The source material reported a Vivaldi release with a fix, a patched Chromium build in a Brave release, and a Microsoft Edge fix still in progress as of November 10. Check your browser vendor’s current release notes.
Do we know who was targeted or what the exploit does?
No. Google has confirmed exploitation but has not disclosed the attackers, targets, scale or technical method. The effects of this specific exploit are also not established in the available information.
Source: ThorstenMeyerAI.com
