Google released a Chrome security update on November 9, 2026, that fixes nine vulnerabilities, including a high‑severity XML use‑after‑free tracked as CVE-2026-125350 that is being exploited in the wild. The release is a priority for Windows, macOS and Linux users.
Patched builds are 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. Distribution will roll out over the coming days and weeks. This update follows an earlier Chrome 157 security release; users must install the newer build to receive these latest fixes.
Chrome zero-day CVE-2026-125350 details
According to Google’s Stable Channel advisory, CVE-2026-125350 is a use‑after‑free vulnerability in XML, recorded under issue 582442907. An anonymous researcher reported the issue on November 6, 2026. Google explicitly stated that an exploit exists in the wild but did not identify attackers, targets, delivery methods, or the exploit’s capabilities.
Use‑after‑free flaws occur when software accesses memory after it releases it. Such errors can cause crashes or, depending on exploit conditions, potentially support code execution. Google has not confirmed those specific outcomes for this XML flaw.
Other patched vulnerabilities
Google lists seven high‑severity fixes in this release beyond the exploited zero‑day. These include:
– CVE-2026-125345: an uninitialized resource in WebGL, issue 550525698, reported August 21; reported internally by Google.
– CVE-2026-125347: incorrect authorization in FileSystem, issue 561996724, reported September 15; reported internally by Google.
– CVE-2026-125343: a buffer overflow in Compositing, issue 561998123, reported September 15; reported internally by Google.
Additional internal findings are CVE-2026-125348, an out‑of‑bounds write in GPU (issue 563358700), reported September 18; and CVE-2026-125344, type confusion in V8 (issue 568893995), reported October 2. The remaining high‑severity issue, CVE-2026-125346, is another XML use‑after‑free (issue 572578603) reported October 12 by Arni Hardarson of Neonix Security; Google has not identified this separate XML vulnerability as exploited and its reward remains to be determined.
Two medium‑severity fixes address uninitialized resources in GPU: CVE-2026-125349 (issue 536663516), reported by Google on July 20; and CVE-2026-125342 (issue 566384898), reported by Vo Duc Thang, known as ugvxb, on September 26. The reward for CVE-2026-125342 remains pending; other entries list rewards as N/A.
Users should open Help > About Google Chrome, install the available update and relaunch the browser. Administrators should verify patched versions across managed devices, as with previous actively exploited Chrome flaws. Google may restrict bug details until most users have updated or until dependent third‑party projects receive fixes.
Administrators are also advised to give their SOC the alert context to stop incidents quickly and to integrate threat intelligence from 16K SOCs.
