Google released an urgent desktop update for Chrome on November 9, 2026 (U.S. time), rolling out versions 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux. The update addresses nine vulnerabilities and, the company says, is being issued in part because exploit code is circulating for CVE-2026-125350, a “use after free” flaw in XML processing.
Google classified CVE-2026-125350 as “High” severity and confirmed that exploit code for that bug “exists in the wild.” The flaw—where a freed memory region continues to be referenced—was reported by an anonymous researcher on November 6, 2026, three days before the patched versions were published. Google did not disclose specific attack methods or targets in its advisory.
Chrome zero-day and the patched bugs
Of the nine fixed issues, seven are rated “High” and two are rated “Medium” under Google’s four-level severity scale; none are listed as “Critical.” Google confirmed only CVE-2026-125350 as having known exploitation. The fixed vulnerabilities are listed by CVE number, short description and severity as provided by Google:
CVE-2026-125350 — Use after free in XML — High (exploitation confirmed)
CVE-2026-125346 — Use after free in XML — High
CVE-2026-125344 — Type confusion in the JavaScript engine “V8” — High
CVE-2026-125343 — Buffer overflow in Compositing — High
CVE-2026-125348 — Out-of-bounds write in GPU — High
CVE-2026-125347 — Inappropriate authorization in FileSystem — High
CVE-2026-125345 — Uninitialized resource in WebGL — High
CVE-2026-125349 — Uninitialized resource in GPU — Medium
CVE-2026-125342 — Uninitialized resource in GPU — Medium
Users running Chrome on desktop platforms are advised to update to the patched versions released on November 9, 2026.
