Google has fixed CVE-2026-125350, a Chrome zero-day that attackers already have an exploit for. The fix shipped on Monday, November 9, 2026, in Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. Google’s Stable Channel Update for Desktop says plainly: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
CVE-2026-125350 is a use-after-free bug in Chrome’s XML handling, rated High. An anonymous researcher reported it on November 6, so the patch reached the stable channel three days after Google heard about it. Google has not published technical details, and it says bug details can stay restricted “until a majority of users are updated with a fix.” The post does not say who is using the exploit or against whom.
What the November 9 update fixes
The release has 9 security fixes. Seven are rated High and two Medium. CVE-2026-125350 is the only one Google says is being exploited.
| CVE | Severity | Component | Bug type | Reported by |
|---|---|---|---|---|
| CVE-2026-125350 | High | XML | Use after free | Anonymous, Nov 6 |
| CVE-2026-125346 | High | XML | Use after free | Arni Hardarson (Neonix Security), Oct 12 |
| CVE-2026-125344 | High | V8 | Type confusion | Google, Oct 2 |
| CVE-2026-125348 | High | GPU | Out of bounds write | Google, Sep 18 |
| CVE-2026-125343 | High | Compositing | Buffer overflow | Google, Sep 15 |
| CVE-2026-125347 | High | FileSystem | Incorrect authorization | Google, Sep 15 |
| CVE-2026-125345 | High | WebGL | Uninitialized resource | Google, Aug 21 |
| CVE-2026-125342 | Medium | GPU | Uninitialized resource | Vo Duc Thang (ugvxb), Sep 26 |
| CVE-2026-125349 | Medium | GPU | Uninitialized resource | Google, Jul 20 |
Two separate use-after-free bugs in XML sit in the same release. Google lists them as different issues with different reporters, a month apart.
Which versions are patched
The update rolls out “over the coming days/weeks,” so some computers will not have it yet. The patched builds are:
- Windows and Mac: 157.0.8103.50 or 157.0.8103.51.
- Linux: 157.0.8103.50.
- Android: 157.0.8103.50, arriving on Google Play “over the next few days.” The Chrome for Android update says Android releases carry the same security fixes as the matching desktop builds.
- Extended Stable (Windows and Mac): 156.0.8078.96. Google’s Extended Stable update lists 11 security fixes, and CVE-2026-125350 is one of them.
The previous stable build, which we covered in our report on Chrome 157 reaching stable, was 157.0.8103.38/.39. Anyone still on that version does not have this fix.
How to check your Chrome version
Open the three-dot menu, then Help and About Google Chrome. Chrome checks for the update, downloads it and shows a Relaunch button. The fix only takes effect after the browser restarts, so a window left open for days can still be running the old code. After relaunch the About page should show 157.0.8103.50 or later. On Android, update Chrome from the Play Store.
Organizations that manage Chrome centrally should check which channel their devices follow. Extended Stable devices need 156.0.8078.96, not 157.
Microsoft Edge and other Chromium browsers
Microsoft Edge is built on Chromium, and its release notes describe each Edge update as incorporating “the latest Security Updates of the Chromium project.” So the Chrome patch does not reach Edge until Microsoft ships its own build. On November 9, Microsoft wrote in its Edge security release notes: “Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.” When we checked on November 10, the notes did not yet list an Edge desktop build that includes the fix.
Until Edge ships its update, the practical step for Edge users is to install it as soon as it appears. Users of other Chromium browsers should watch their vendor’s release notes.
Why “exploit in the wild” changes the priority
The November 3 release fixed 213 security bugs, and Google flagged none of them as exploited. This one is different. Someone already has a working exploit, so every day a browser stays on the old build is a day it can be attacked with a known tool. Our explainer on what a zero-day vulnerability is covers how a fix like this one goes from report to release.
