🔍 Read the full analysis: Attackers Use Chrome’s XML Bug: Steps To Find Your Updated Version on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome updates on November 9, 2026, fixing a high-severity XML use-after-free flaw that it says is being exploited. Users should check for the fixed version and relaunch Chrome; other Chromium-based browsers need their own vendor updates.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that the company says is being exploited in the wild. The warning means attacks are already using the vulnerability, though Google has not said who is behind them or who has been targeted.
Google’s release notes describe the issue as “Use after free in XML” and rate it high severity. The bug was reported by an anonymous researcher on November 6, according to the company’s notes. Google published the fixes three days later, but says desktop updates will roll out over the coming days or weeks. The Android release is expected to become available through Google Play over the next few days.
The fixed versions listed by Google are 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Organizations using the Extended Stable channel should look for 156.0.8078.96 on Windows and Mac. Google’s update also fixes another XML use-after-free, CVE-2026-125346, reported in October; its notes do not say that second flaw is being exploited.
To check Chrome on a computer, open the three-dot menu, choose Help, then About Google Chrome. The browser checks for an update there; if one is downloaded, select Relaunch to apply it. On Android, check Chrome’s listing in Google Play for an Update button. The version number is also available in Chrome’s Settings under About Chrome. A downloaded update does not take effect until the browser restarts.
Attackers use Chrome’s XML bug Check your updated version
Google says attackers are exploiting a high-severity flaw. Check Chrome on every device, install the available update and relaunch the browser.
What the flaw means
CVE-2026-125350 is an XML use-after-free flaw. Google confirms exploitation but has not shared attacker, target or method details.
An active security risk
A use-after-free error can cause crashes or data corruption; the specific impact of this flaw is not known.
Other browsers need their own fixes
Edge, Brave, Vivaldi and Opera depend on their vendors to distribute updates. A Chrome update does not patch them.
Check and apply the update
Chrome desktop updates roll out in stages; Android availability follows through Google Play.
On a computer, open the three-dot menu, then Help → About Google Chrome. On Android, check Chrome in Google Play.
Look for 157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux, or Chrome 157 (157.0.8103.50) on Android.
When the update downloads, select Relaunch. The fix does not take effect until the browser restarts.
What is known so far
Google reported a three-day gap between the anonymous report and the Stable Channel fix.
Why the Exploited XML Flaw Matters
The immediate concern is that Google says an exploit exists in the wild, rather than describing the issue only as a theoretical risk. A use-after-free bug occurs when software reuses memory after it has been released. Depending on the circumstances, this kind of memory error can cause a crash, corrupt data or potentially allow code execution; the available information does not establish what attackers can achieve with this particular flaw.
Users who have not received the update may remain exposed while the rollout proceeds. The issue also reaches beyond Chrome itself: browsers built on Chromium, including Edge, Brave, Opera and Vivaldi, depend on their vendors to ship and distribute fixes. Installing Chrome’s update does not update those other browsers.
Popular right now
Philips 3300 Series Fully Automatic Espresso Machine with Milk Frother, Grinder, Hot and Iced Coffee Presets, SilentBrew, 15-Bar Pressure (E
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Ninja Crispi Microwave & Air Fryer with FusionCrisp Technology, 14-in-1, Black (MW101BK1)
As an affiliate, we earn on qualifying purchases.
A Three-Day Fix Timeline
Google’s notes say the bug was reported anonymously on Friday, November 6, and that a fix appeared in the November 9 Stable Channel update. The company has restricted details about the vulnerability. Limiting technical information while users install patches can reduce the chance of providing attackers with a ready-made guide, but it also leaves the public without specifics about the exploit.
The source report counted eight Chrome flaws in 2026 for which Google said it was aware of exploitation in the wild, based on the company’s release notes. That is a count of reported exploited vulnerabilities, not a measure of the number of attacks or affected users. The report says four of those eight involved Chrome’s V8 JavaScript engine. Google’s current advisory establishes exploitation of this XML flaw but does not provide a target list or attack details.
Other Chromium browser releases were at different stages as of November 10. The source report says Microsoft had acknowledged awareness of recent exploits and was working on an Edge fix, without listing a fixed version. It reports that Vivaldi’s desktop update included a fix, and that Brave listed a release built on the fixed Chromium version. The report found no Opera desktop update mentioning the flaw at that time. These are time-sensitive vendor-status details and should be checked against current release notes.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not disclosed who is conducting the attacks, which users or organizations were targeted, or how the exploit works. The company’s public description does not identify the exact part of XML handling involved or say whether exploitation requires a particular user action. It is also not clear how many Chrome users had received the fix by November 10.
The source report found no ChromeOS or Chrome for iOS release note mentioning this flaw as of November 10. That does not establish whether those products are affected or when a fix might appear. Status can also change quickly for Chromium-based browsers, so users should check their browser maker’s current advisories rather than assume a Chrome release covers them.
Check for Updates and Vendor Notices
Chrome users should check the version installed on each device and restart the browser after an update downloads. Because Google is distributing the desktop release in stages, a manual check may show an update before automatic delivery does. Android users should monitor Google Play and install the update when it becomes available.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should follow that vendor’s release notes for a fixed version. Google’s Chrome version numbers do not by themselves confirm that a separate browser has received the relevant patch. Further details may emerge if Google loosens its restrictions on the vulnerability information or vendors publish updates.
Key Questions
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should look for 156.0.8078.96.
How do I check whether Chrome is updated?
On a computer, open Chrome’s three-dot menu and go to Help → About Google Chrome. Chrome checks for an update on that page. Relaunch the browser after it downloads. On Android, check Chrome in Google Play for an Update option.
What does Google mean by exploitation in the wild?
Google says an exploit for the vulnerability exists and is being used outside a lab setting. Its public notice does not identify the attackers, targets or methods, so the scope and nature of the attacks remain unknown.
Does updating Chrome also fix Edge or other Chromium browsers?
No. Each browser vendor distributes its own updates. Check the release notes for Edge, Brave, Vivaldi, Opera or any other browser you use, and install its fixed release when available.
What is a use-after-free flaw?
It is a software memory error in which a program uses memory after it has been released. Such flaws can have different effects, including crashes or data corruption; Google has not publicly described the specific impact or exploit method for CVE-2026-125350.
Source: ThorstenMeyerAI.com
