Google released Chrome 157.0.8103.50 on Nov. 9 with fixes for nine security issues, and for one of them the company says an exploit already exists in the wild. The flaw, CVE-2026-125350, is a high-severity use-after-free in Chrome’s XML component, reported anonymously on Nov. 6. It is the eighth actively exploited Chrome zero-day Google has patched in 2026, by The Hacker News’s count.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The stable build is 157.0.8103.50 or .51 for Windows and Mac and 157.0.8103.50 for Linux, and it reaches users gradually over the coming days and weeks rather than all at once. Because the rollout is staged, a browser left running for days can sit on the vulnerable build long after the fix exists, and only a relaunch completes the change. Google’s post lists the nine issues by CVE, severity and category: seven are rated High and two Medium, and CVE-2026-125350 is the only one carrying the exploit statement. Anyone running Chrome on a managed fleet will be waiting on an administrator’s deployment schedule for the same fix.
CVE-2026-125350, the XML use-after-free
Google’s Stable Channel Update for Desktop rates CVE-2026-125350 as High and tracks it under bug ID 582442907. The post contains a single sentence on exploitation: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” Google has not said how the flaw is being abused or who is behind the attacks, and the post notes that some bug details may stay restricted until most users have updated.
A use-after-free happens when a program keeps using a block of memory after releasing it, so that data an attacker controls can land where the program expects its own. In a component that parses XML, a malformed document is the natural trigger, and a browser parses XML from many sources, including web pages, feeds and documents. Google’s post does not say which route the exploit takes, so the description here is of the bug class, not of the attack. The timeline is short: an anonymous researcher reported the bug on Nov. 6, and a patched build was published on Nov. 9, three days later.
Reporting by The Hacker News adds that a use-after-free of this kind can lead to data corruption, program crashes or arbitrary code execution. Google may also keep restrictions in place longer if a bug touches a third-party library that other projects depend on and that has not yet been fixed. No CVSS score has been published for the flaw. A second XML bug, CVE-2026-125346, was fixed in the same release and is also rated High. Arni Hardarson of Neonix Security reported it, and Google’s post attaches no in-the-wild statement to it.
Eight exploited Chrome zero-days in 2026
The Hacker News lists the year’s eight as CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, CVE-2026-87491 and now CVE-2026-125350. The first of them, CVE-2026-2441 in February opened a year in which exploited Chrome bugs have come up again and again. BleepingComputer’s report on the fourth exploited bug of the year shows the tally was already climbing by spring.
The other seven fixes in Chrome 157.0.8103.50
Alongside the XML pair, the release fixes an uninitialized resource in WebGL (CVE-2026-125345), incorrect authorization in FileSystem (CVE-2026-125347), a buffer overflow in Compositing (CVE-2026-125343), an out-of-bounds write in GPU (CVE-2026-125348) and a type confusion in V8 (CVE-2026-125344), all rated High. Two uninitialized-resource bugs in GPU, CVE-2026-125349 and CVE-2026-125342, are rated Medium. Vo Duc Thang of ugvxb is credited with CVE-2026-125342, and the remaining reports came from Google or anonymous researchers. A zero-day, in the term’s usual sense, is a flaw that attackers use before a fix exists, and the label counts here because Google’s note says an exploit was already circulating. The list spans six components, WebGL, FileSystem, Compositing, GPU, V8 and XML, which is typical of a Chrome security release: one exploited bug sitting among a spread of memory-safety and authorization fixes that Google rates on severity but has not reported as exploited.
Relaunching Chrome and other Chromium browsers
Google’s update instructions are short: open the More menu, choose Help, then About Google Chrome, and click Relaunch once the check finishes. Chrome checks for updates while that page is open, and a missing Relaunch button means the installed copy is already current. Dismissing the prompt is allowed, in which case the update applies the next time the browser restarts, which for a laptop that sleeps instead of shutting down can be a long wait. Open tabs and windows reopen after the restart, though Incognito windows do not. Linux installs update through the package manager, and Chromebooks update through the operating system. The Hacker News adds that Microsoft Edge, Brave, Opera and Vivaldi should take the Chromium fix when their makers ship it.
Still unanswered is what attackers did with the bug. Google’s post names no victims, no malware and no delivery method for CVE-2026-125350, and it says detail may remain restricted until most users have updated. Until Google lifts that restriction, the practical record is the version number: 157.0.8103.50 or .51 on Windows and Mac, 157.0.8103.50 on Linux, and nothing older closes the hole.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
- Winter weather advisories cover I-80, I-70 and the Bighorns with up to 15 inches of snow
- Arizona’s governor declared a statewide emergency after Flagstaff logged its wettest Nov. 1 on record
- Zero Motorcycles unveiled an electric motorcycle targeted at under $8K and a street-legal dirt bike at EICMA
