🔍 Read the full analysis: Chrome’s Eighth Zero-Day Of 2026: What To Know About The XML Bug And Update on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome updates on Nov. 9 for a high-severity use-after-free flaw in its XML component, CVE-2026-125350, and says an exploit is being used in the wild. The update is rolling out across listed platforms; users should check for it and relaunch Chrome after installation. Google has not disclosed who is being targeted or how the attacks work.
Google released Chrome updates on Monday, Nov. 9, to fix CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component that the company says is being exploited. Google’s release notes make this the eighth Chrome flaw it has flagged as exploited in the wild in 2026; the update is rolling out to desktop and Android users.
Google described the vulnerability as a “use after free in XML” and rated it high severity. The flaw was reported by an anonymous researcher on Friday, Nov. 6, according to Google’s release notes, and the fix followed three days later. Google says the desktop update will roll out over the coming days or weeks, rather than reaching every device at once.
The fixed versions listed by Google are 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Chrome 157, version 157.0.8103.50, for Android. Organizations using Extended Stable on Windows or Mac should look for 156.0.8078.96. Google said the Android release would become available through Google Play over the next few days.
The same update fixes another XML use-after-free flaw, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on Oct. 12. Google’s notes do not say that this second vulnerability is being exploited. To check Chrome on a computer, open the three-dot menu, select Help, then About Google Chrome; install any offered update and click Relaunch. On Android, check Chrome’s Google Play listing for an update.
Chrome’s XML Zero-Day What to know and do
Google says an exploit for a high-severity Chrome flaw is being used in the wild. Check for the update and relaunch Chrome after it installs.
What Google confirmed
CVE-2026-125350 is a high-severity use-after-free flaw in Chrome’s XML component.
Exploitation in the wild
Google says an exploit exists, but has not described the attacks or their impact.
Another XML flaw fixed
The update also fixes CVE-2026-125346; Google has not said it is being exploited.
Rollout and fixed versions
Desktop updates arrive over coming days or weeks; Android availability comes through Google Play.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux and Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Protect your browser
A published fix does not mean every device has received it yet.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Chrome in Google Play.
Apply any offered update and click Relaunch on desktop so the fixed version is running.
Edge, Brave, Vivaldi, Opera and other Chromium-based browsers need updates from their own vendors.
What remains unknown
Google has limited technical details while the fix is being distributed.
- High severity
- Exploit used in the wild
- Vulnerable area: XML component
- Attackers or targets
- How the exploit works
- Scale or impact of attacks
Why the Exploited XML Bug Matters
The immediate concern is that attack code exists before all users have received the fix. Google’s statement confirms exploitation in the wild but does not describe the attacks, affected users or their scale. A high-severity rating signals that Google considers the flaw serious, but the available notes do not establish what an attacker can achieve in each attack or whether exploitation requires particular conditions.
Chrome’s staged release means a fix being published does not automatically mean every installation is protected. Users can check manually rather than waiting for the rollout, and should restart Chrome after the update downloads so the fixed version is running. The issue may also matter to people using other Chromium-based browsers, but Google’s Chrome patch does not itself update those products.
Popular right now
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
DREAME A3 AWD 1000 LiDAR Robot Lawn Mower
Breville Barista Express Espresso Machine with Built-In Grinder, Black Sesame
As an affiliate, we earn on qualifying purchases.
How the Chrome Fix Rolled Out
A use-after-free is a memory-handling error: software releases memory, then later tries to use it again. Depending on how the error can be triggered and controlled, such bugs can cause crashes or other security consequences. The Hacker News noted that this category of flaw can lead to data corruption, crashes or arbitrary code execution; that is general context about the bug type, not a statement from Google about the outcome of this specific vulnerability.
Google’s notes identify the affected area only as Chrome’s XML component. XML is a structured-data format used in browser-related content, including SVG graphics and XML documents, but Google has not said which part of its XML handling is vulnerable. The eighth-in-2026 count comes from the release notes’ repeated statement that Google is aware of an exploit in the wild. The seven earlier vulnerabilities named in the source account include CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; and CVE-2026-85046 and CVE-2026-87491 in September.
Other browser makers may need to ship their own updates. As of Nov. 10, Microsoft said it was working on an Edge security fix. Vivaldi said its desktop 8.3 update included a fix, while Brave’s listed v1.99.56 release was based on the fixed Chromium 157.0.8103.50 version, though its release text did not mention the CVE. The source found no Opera desktop update mentioning the flaw and no Chrome for iOS or ChromeOS release note addressing it at that time.
““Google is aware that an exploit for CVE-2026-125350 exists in the wild.””
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not identified who is behind the attacks, who may have been targeted or how the exploit works. The company has restricted technical details while the fix is being distributed. Its public statement confirms exploitation, but does not say how many incidents have occurred, whether attacks are targeted or broad, or what impact they have had.
It is also not clear from the release notes when every Chrome installation will receive the update. As of Nov. 10, the source material found no Chrome for iOS or ChromeOS release note mentioning CVE-2026-125350. The status of those products, and the timing of fixes for browser vendors that had not yet published one, remained unsettled.
Check for Browser Updates
Chrome users should check the version installed on their device, apply the update if available and relaunch the browser. Android users can check Google Play, while desktop users can use Chrome’s About page. Organizations on Extended Stable should verify that their Windows and Mac systems have received version 156.0.8078.96.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should follow that browser maker’s release notes and update schedule. Google’s next releases, along with vendor advisories, may clarify coverage for platforms not listed in the Nov. 9 notes. Further technical details about CVE-2026-125350 and the attacks remain dependent on Google’s future disclosures.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild but has not described the vulnerable code path or attack method.
Which Chrome versions fix the vulnerability?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and Extended Stable 156.0.8078.96 for Windows and Mac.
How do I make sure the update is active?
Check Chrome’s About page on a computer or its Google Play listing on Android. After downloading a desktop update, click Relaunch; the browser must restart to run the updated version.
Does this affect other Chromium-based browsers?
They may require separate updates from their makers. Chrome’s update does not automatically patch Edge, Brave, Vivaldi, Opera or other Chromium-based browsers. Check the vendor’s release notes for its own status.
What is known about the attacks?
Google has confirmed that an exploit is being used in the wild. It has not disclosed the attackers, targets, attack method or scale.
Source: ThorstenMeyerAI.com
