CVE-2026-125350: Chrome 157.0.8103.50 fixes a zero-day exploited in the wild

Google shipped a Chrome Stable update on 9 November 2026 that fixes nine security bugs, and one of them, CVE-2026-125350, is already being used in attacks. Google's release note says the company "is aware that an exploit for CVE-2026-125350 exists in the wild". The bug is a use-after-free in Chrome's XML code, rated High, and the fix is in Chrome 157.0.8103.50 (Windows and Mac: 157.0.8103.50/.51). Because Chrome only applies the update after a restart, anyone who left the browser open for days is still exposed.

Key points

• CVE-2026-125350, a High-severity use-after-free in Chrome's XML component, has an exploit in the wild, according to Google's Chrome Releases post of 9 November 2026.
• The fix is in Stable 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux; Google says the rollout takes "days/weeks", so check manually.
• The update fixes nine bugs in total: seven rated High and two Medium. A second XML use-after-free, CVE-2026-125346, is among them.
• Google's table lists CVE-2026-125350 as reported by an anonymous researcher on 6 November 2026, three days before the fix shipped.
• Chrome for Android has 157.0.8103.50 and carries the same security fixes, arriving on Google Play over the next few days.

What to do

1. Update Chrome now. Open the menu, go to Help, then About Google Chrome, let it download, and select Relaunch. The fix is not active until the browser restarts. Check that the version reads 157.0.8103.50 or later (on Windows and Mac, 157.0.8103.51 is also fine).
2. Linux: update through your package manager or Google's repository and restart Chrome; the fixed build is 157.0.8103.50.
3. Android: open Google Play and update Chrome. Google says the 157.0.8103.50 build will become available over the next few days.
4. Managed fleets: the Extended Stable channel gets a separate build. Security outlets that read the Chrome Releases post report it as 156.0.8078.96 for Windows and Mac; confirm that number in your admin console before you rely on it.
5. Other Chromium browsers (Edge, Brave, Opera, Vivaldi and others) reuse Chrome's engine. We have not checked each vendor's release notes, so install their next update as soon as it appears, and treat any browser that has not yet shipped a build based on the 9 November fixes as potentially exposed.
6. How to check if you are affected: any Chrome older than 157.0.8103.50 is affected by the bugs fixed in this update. Google has not said which earlier versions the exploit works against, and we have not seen an indicator of compromise published anywhere, so there is nothing to scan for beyond the version number.

What happened

On Monday 9 November 2026 Google published "Stable Channel Update for Desktop" on the Chrome Releases blog. The Stable channel moved to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out "over the coming days/weeks". The note says the update includes nine security fixes and points readers to the Chrome Security Page.

Eight of the nine entries carry only a short description, a bug number and a reporter. The ninth is different. Beneath the list, Google adds a single sentence: it is aware that an exploit for CVE-2026-125350 exists in the wild. That is the wording Google uses for bugs exploited before a fix existed, bugs that attackers were using before a fix existed. The company did not say who is using the exploit, against whom, or how many people were targeted.

The release note's table lists the following bugs:

• High: CVE-2026-125345, uninitialized resource in WebGL (reported by Google, 21 August).
• High: CVE-2026-125347, incorrect authorization in FileSystem (Google, 15 September).
• High: CVE-2026-125343, buffer overflow in Compositing (Google, 15 September).
• High: CVE-2026-125348, out of bounds write in GPU (Google, 18 September).
• High: CVE-2026-125344, type confusion in V8, Chrome's JavaScript engine (Google, 2 October).
• High: CVE-2026-125346, use after free in XML (Arni Hardarson of Neonix Security, 12 October).
• High: CVE-2026-125350, use after free in XML (anonymous, 6 November).
• Medium: CVE-2026-125349, uninitialized resource in GPU (Google, 20 July).
• Medium: CVE-2026-125342, uninitialized resource in GPU (Vo Duc Thang, 26 September).

Six of the nine were reported by Google itself, which is typical of bugs found by internal fuzzing and review. The exploited bug is an exception: it came from an anonymous reporter, only three days before the patch shipped. Whether that reporter found it independently or discovered it by analysing an attack is not stated, and we will not guess.

Background

Chrome 157 reached the Stable channel on 3 November 2026 with 213 security fixes, seven of them rated Critical, according to the security site GBHackers, which listed two buffer overflows in Dawn, memory corruption in ANGLE and use-after-free bugs in WebGL, Prerender, Geometry and Core. Build 157.0.8103.38 was the Linux version of that release. The 9 November build is therefore an out-of-band style follow-up on top of a very large release: six days after the 213-fix drop, Google shipped a short update containing one bug it knows is under attack.

A use-after-free happens when a program frees a piece of memory and then keeps using the pointer to it. If an attacker can control what gets placed in that memory afterwards, the program may read or run data the attacker chose. In a browser, such bugs are usually reached through a crafted web page, and they are typically chained with a second bug to escape the browser's sandbox. Google's note does not say whether CVE-2026-125350 was used on its own or as part of a chain.

Chrome's XML code is not one of the headline attack surfaces most people think about, yet two of the nine fixes here sit in it. That is a reminder that a browser parses many formats beyond HTML, including XML documents, feeds and the transformations applied to them.

How the nine fixes break down

Grouped by the component Google names, GPU is the most frequent location, with three entries (one High, two Medium), followed by XML with two. Every other component has one.

GPU3

XML2

WebGL1

FileSystem1

Compositing1

V81

Chrome 157.0.8103.50 security fixes by component (9 fixes) (fixes)

	fixes
GPU	3
XML	2
WebGL	1
FileSystem	1
Compositing	1
V8	1

Source: Chrome Releases, Stable Channel Update for Desktop, 9 November 2026

By severity, seven are High and two are Medium; none is rated Critical in this update.

High7

Medium2

Chrome 157.0.8103.50 fixes by severity (fixes)

	fixes
High	7
Medium	2

Source: Chrome Releases, Stable Channel Update for Desktop, 9 November 2026

What it means

For everyday users, the practical risk is simple: if you keep Chrome open for weeks and never restart it, you may be running a vulnerable build even though an update has downloaded. A restart is the whole fix.

For IT teams, the combination of a known exploited bug and a rollout measured in "days/weeks" argues for pushing the update through policy rather than waiting. Extended Stable users should watch for the separate 156-series build. Browsers built on Chromium need their own vendor updates, and the gap between Chrome's release and a derivative's release is the window during which those users remain exposed.

For defenders, Google's habit of restricting bug details until most users are updated means there is no public technical write-up of CVE-2026-125350 yet. Expect proof-of-concept analysis to follow once the restriction lifts, which tends to raise the risk for anyone who has not updated.

What we don't know yet

• Who is exploiting CVE-2026-125350, against which targets, and whether it was chained with other bugs.
• Whether the bug is also reachable in browsers that embed Chromium's XML code in other ways, such as desktop apps built on Electron or similar frameworks. We found no statement from the vendors involved.
• Whether CISA has added the CVE to its Known Exploited Vulnerabilities catalog. We could not read that catalog during our research, so we cannot confirm either way.
• The exact Extended Stable build number. We relied on secondary reports for 156.0.8078.96 because we could not open Google's Extended Stable post.
• Whether Google will add details when the restrictions on bug reports lift.

What to watch next

Watch the Chrome Releases blog for any change to the CVE-2026-125350 entry or a follow-up build, the release notes of Edge, Brave, Opera and Vivaldi for fixes based on this update, and the CISA Known Exploited Vulnerabilities catalog, which sets patch deadlines for US federal agencies once a bug is listed. Researchers' technical write-ups should appear after Google lifts the access restriction on the bug reports.

Sources

• Google Chrome Releases: Stable Channel Update for Desktop, 9 November 2026 (primary source)
• Google Chrome Releases: Chrome for Android Update, 9 November 2026
• Cryptika: Google Chrome 0-day vulnerability in the wild to execute malicious code remotely (Extended Stable build number and recommendations)
• GBHackers: Google Chrome 157 released with 213 security fixes (3 November release)