🔍 Read the full analysis: Chrome’s Eighth 2026 Zero-Day Explained In 5 Key Points on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome security updates on Nov. 9, 2026, fixing nine vulnerabilities, including CVE-2026-125350, a high-severity XML use-after-free bug that Google says is being exploited. The flaw is the eighth Chrome vulnerability Google has flagged as exploited in the wild this year. Google has not disclosed who is behind the attacks, who was targeted or how the exploit works.
Google released a Chrome security update on Nov. 9 that fixes nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says it is aware of an exploit for the flaw being used in the wild, making this the eighth Chrome vulnerability it has flagged as exploited in 2026 and a reason for users to check for and install the update.
Google’s Chrome Releases notice describes CVE-2026-125350 as a “use after free in XML” and rates it high severity. The company says an exploit exists in the wild, but has not published technical details about how it works. The issue was reported by an anonymous researcher on Friday, Nov. 6; Google released the fix three days later, on Monday.
Google lists these fixed versions: 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using the Extended Stable channel should look for 156.0.8078.96 on Windows and Mac. Google says desktop updates will roll out over the coming days or weeks, while the Android release is due on Google Play over the next few days.
The update also addresses a separate XML use-after-free vulnerability, CVE-2026-125346, which Google credits to researcher Arni Hardarson of Neonix Security. Google’s release notes do not say that this second flaw is being exploited. Users can check Chrome on desktop through the menu’s Help and About Google Chrome page; after an update downloads, they must relaunch the browser to apply it. Android users can check Google Play for an update.
Chrome’s Eighth 2026 Zero-Day Explained in 5 Key Points
Google says attackers are exploiting a high-severity Chrome flaw. The update fixes nine vulnerabilities, but protection depends on installing the fix and restarting your browser.
What Google confirmed
The active-exploitation warning applies to CVE-2026-125350, not every issue in the update.
XML use-after-free
Google describes CVE-2026-125350 as a use-after-free bug in Chrome’s XML component.
Another XML fix
The update also fixes CVE-2026-125346. Google does not say this flaw is being exploited.
Attacks remain unclear
Google has not disclosed the attackers, targets, scale or how the exploit works.
Check and apply the fix
The update is rolling out in stages, so it may not appear immediately.
On desktop, open Help, then About Google Chrome. On Android, check Google Play.
Google lists version 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux and Android.
On desktop, restart the browser after the update downloads to apply the protection.
Other Chromium browsers need their own fixes
A Chrome release does not confirm that another browser has received the patch.
- Vivaldi said its desktop update included the fix.
- Brave’s listed release was built on Chromium 157.0.8103.50.
- Microsoft said it was working on an Edge fix.
- No matching Opera update was identified in the source material.
What remains unknown
The public release notes do not establish the scope or impact of attacks.
Why the Active Exploit Matters
The disclosure means this is not just a vulnerability found during routine testing: Google says attackers are exploiting it, while the public technical details remain limited. Installing the fixed version reduces the risk from this particular Chrome flaw, but the protection only takes effect after the browser updates and restarts.
The issue also matters to people who use browsers built on Chromium, the open-source browser project underlying Chrome. Those products depend on their own vendors to incorporate and distribute fixes. Google’s Chrome release does not, by itself, confirm that another Chromium-based browser is protected. Users and IT teams should check the release notes and update status for the browser they actually use.
Products Worth Considering
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
As an affiliate, we earn on qualifying purchases.
How This Fits Chrome’s 2026 Record
Google’s release notes identify CVE-2026-125350 as the eighth Chrome flaw in 2026 for which the company has said an exploit exists in the wild. The seven earlier entries listed in the source material are CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; and CVE-2026-85046 and CVE-2026-87491 in September. This count reflects Google’s wording in its release notes, rather than a count of every Chrome vulnerability discovered this year.
The Chrome update covers nine security fixes, not only the actively exploited bug. Google’s notes also list a second XML use-after-free, but do not say it has been exploited. The distinction matters: the active-exploitation warning applies specifically to CVE-2026-125350 based on the information Google has released.
“The update will roll out over the coming days/weeks.”
— Google, on the desktop update rollout
What Google Has Not Disclosed
Google has not said who is behind the attacks, which users or organizations were targeted, or how the exploit works. It has restricted details about the vulnerability, limiting what can be independently assessed from the public release notes. The existence of in-the-wild exploitation is Google’s statement; the available material does not establish the scale or impact of attacks.
As of Nov. 10, the source material also reports no Google release-note entry for Chrome on iOS or ChromeOS that mentions this flaw. It does not establish whether those platforms are affected or when a relevant update might appear. Browser status can change as vendors publish fixes, so the versions and vendor notes cited here reflect information available at that date.
Updates Across Chrome and Chromium
Chrome users should check for the fixed version and restart the browser after installation. Google says the desktop rollout will continue over the coming days or weeks, and the Android build is expected to become available through Google Play over the next few days. Users who do not yet see an update can check again as the rollout proceeds.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should consult that browser’s own update page rather than assume Google’s Chrome release has already reached them. In the source material, Vivaldi said its desktop update included a fix for CVE-2026-125350, and Brave’s listed release was built on Chromium 157.0.8103.50. Microsoft said it was working on an Edge fix, while no matching Opera update was identified. Those vendor statuses may change as new releases are published.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild but has not publicly explained how it works.
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How do I apply the Chrome update?
On desktop, open Chrome’s menu, select Help, then About Google Chrome, and relaunch after the update downloads. On Android, check Google Play for a Chrome update.
Does this affect other Chromium-based browsers?
They may need separate vendor updates. Chromium-based browsers do not necessarily receive a fix at the same time as Chrome, so check the release notes or update status for your browser.
What is known about the attacks?
Google confirms that an exploit exists in the wild. It has not disclosed the attackers, targets, scale of exploitation or technical details of the exploit.
Source: ThorstenMeyerAI.com
