🔍 Read the full analysis: A New Chrome Zero-Day Involves XML: Which Version Should You Install? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome updates on November 9 addressing CVE-2026-125350, a high-severity XML use-after-free flaw that the company says is being exploited. Install Chrome 157.0.8103.50 or .51 on Windows and Mac, 157.0.8103.50 on Linux and Android, or 156.0.8078.96 on Extended Stable for Windows and Mac. Details about the attacks and targets remain undisclosed.
Google released Chrome security updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free flaw in the browser’s XML component. Google said an exploit for the vulnerability exists in the wild, making the patched versions the immediate priority for Chrome users; the company has not disclosed who is being targeted or how the attacks work.
Google’s release notes list Chrome 157.0.8103.50 or .51 for Windows and Mac, and 157.0.8103.50 for Linux. Android users should install Chrome 157, version 157.0.8103.50. Organizations using the Extended Stable channel on Windows or Mac should update to 156.0.8078.96. Google said desktop updates would roll out over the coming days or weeks, while the Android release would become available through Google Play over the next few days.
The vulnerability is described as a use after free in XML. That kind of memory-management error occurs when software uses a portion of memory after it has been released. Depending on how it is exploited, such flaws can cause crashes or data corruption and may allow more serious attacks; Google has not said what this particular exploit can do. The company rated CVE-2026-125350 High severity.
Google’s notes say the bug was reported by an anonymous researcher on November 6, three days before the update was published. The same release also fixes CVE-2026-125346, another XML use-after-free issue, reported by Arni Hardarson of Neonix Security on October 12. Google did not say that the second flaw is being exploited.
Chrome’s XML zero-day which version to install
Google says CVE-2026-125350 is being exploited. Install the fixed version for your platform and relaunch Chrome to complete the update.
Install the fixed version
Check your platform’s version, then relaunch the browser if prompted.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Complete the update
Downloading the update alone does not activate the fix.
On desktop, open Help, then About Google Chrome, and let the update download.
Select Relaunch to finish installation.
Look for a Chrome update in Google Play and check the installed version.
What is confirmed
The flaw is a use-after-free in Chrome’s XML component.
- An exploit exists in the wild.
- The issue is rated High severity.
- Security details are restricted.
- Who is being targeted.
- How the attacks work.
- How many devices or users are affected.
Check other Chromium browsers
Each browser vendor must release its own update.
Desktop fix reported
Vivaldi said its desktop update includes the fix.
Patched Chromium listed
Brave listed a release built on Chromium 157.0.8103.50.
Fix in progress
Microsoft said it was working on a fix; no patched version was listed in the material available on November 10.
Patched Versions by Platform
The risk is not limited to people who use Chrome for sensitive work: the browser may process web content that triggers a vulnerability without users knowing that a flaw is involved. Google’s statement that an exploit is already being used means users should check for the update and restart the browser, rather than assume an update will be applied immediately in the background.
To check Chrome on a computer, open the three-dot menu, select Help, then About Google Chrome, and let the browser download any available update. Select Relaunch to complete installation; downloading alone does not activate the fix. On Android, check Google Play for a Chrome update, and look under Chrome’s Settings and About Chrome to view the version.
Other Chromium-based browsers do not necessarily receive Google’s fix at the same time. Their makers must release their own browser updates. Microsoft said on November 9 that it was working on a fix for Edge and acknowledged recent exploits, but did not list a patched version in the material available on November 10. Vivaldi reported a desktop update that includes the fix, while Brave listed a release built on the patched Chromium version. Users of other browsers should check their vendor’s release notes rather than treating a Chrome update as proof that their browser is protected.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 24GB Memory, 1TB SSD, Midnight
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and 12MP Center Stage Camera (2026, Silver)
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 2TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
How the Chrome Fix Emerged
Google’s security release identifies the affected area as Chrome’s XML component, but does not specify which part of XML processing is vulnerable. Browsers handle XML-based content in different places, including SVG graphics and XML documents. Without further technical details, users cannot infer from the release notes which content or browsing activity was involved in the reported attacks.
The November 9 update fixes nine security issues, according to the source material. CVE-2026-125350 is the issue singled out by Google’s warning that an exploit exists in the wild. The source’s review of Google’s 2026 Chrome release notes counts eight vulnerabilities this year for which Google used that warning. That is a count of disclosures in Google’s notes, not a measure of how many attacks occurred or how many users were affected.
Google’s release notes say security details are restricted while the company works to limit the chance of further exploitation. That approach leaves users with a clear action—install the fixed version—but few public details for judging the scope or mechanics of the attacks.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not publicly identified who is behind the exploitation, which users or organizations were targeted, or how the exploit works. The company’s notice confirms in-the-wild exploitation but does not give a count of attacks, affected devices or successful compromises. The severity rating alone does not establish that every Chrome user has been exposed.
It is also not clear from the available release notes whether the same attack method affects every platform, or when every user will receive the update. The source material did not identify a corresponding Google release note for Chrome on iOS or ChromeOS as of November 10. Users on those platforms should watch for guidance from Google; the absence of a listed notice in the reviewed material does not establish that they are affected or unaffected.
For browsers built on Chromium, release timing and fixed versions depend on each vendor. Edge had not listed a patched version in the reported notes on November 10. The status for browsers whose vendors had not published relevant release information remains unconfirmed.
Check Updates From Each Vendor
Chrome users should confirm that their browser has reached the applicable fixed version and relaunch it if prompted. Google’s rollout may take days or weeks on desktop, and Android availability may vary as the update reaches Google Play. If the fixed version is not yet offered, users can check again later and monitor Google’s Chrome Releases information.
People using Edge, Vivaldi, Brave, Opera or another Chromium-based browser should check that browser’s own update mechanism and security notes. At the time covered by the source material, Vivaldi said its desktop update included the CVE-2026-125350 fix, and Brave had listed a release using Chromium 157.0.8103.50. Microsoft said an Edge fix was in progress; no corresponding Opera update mentioning the flaw was listed.
Google may publish more technical details after it considers the risk of further exploitation lower. Until then, the confirmed guidance is to install the vendor’s patched version when available, complete any required restart and avoid assuming that one browser’s update covers another.
Key Questions
Which Chrome version fixes the XML zero-day?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux and Chrome 157, version 157.0.8103.50, for Android. Extended Stable users on Windows and Mac should install 156.0.8078.96.
Has Google confirmed that the flaw is being exploited?
Yes. Google said an exploit for CVE-2026-125350 exists in the wild. It has not publicly provided details about the attackers, targets or methods.
How do I install the Chrome fix?
On a computer, open Chrome’s three-dot menu, go to Help and About Google Chrome, allow the update to download, then select Relaunch. On Android, check Google Play for a Chrome update. The browser must restart to complete the desktop update.
Are Edge and other Chromium browsers already patched?
Not necessarily. Each browser vendor must distribute its own update. Microsoft said it was working on an Edge fix but had not listed a patched version in the information available on November 10. Check your browser maker’s release notes for current status.
What is still unknown about the attacks?
Google has not said who is responsible, who was targeted, how the exploit works or how many attacks occurred. The company has restricted technical details for now.
Source: ThorstenMeyerAI.com
