🔍 Read the full analysis: Chrome And The 2026 XML Zero-Day: Which Version Do You Need? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome updates on November 9, 2026, fixing CVE-2026-125350, a high-severity XML use-after-free flaw the company says is being exploited. Most desktop users need Chrome 157.0.8103.50 or .51, while Extended Stable users need 156.0.8078.96; Android users should install Chrome 157. The attack method, targets and attackers have not been disclosed.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in the browser’s XML component. Google says an exploit for the vulnerability exists in the wild, so users should check for the patched version rather than wait for the staged rollout to reach them.
For most desktop users, Google lists Chrome 157.0.8103.50 or .51 for Windows and Mac, and 157.0.8103.50 for Linux. Android users should install Chrome 157, version 157.0.8103.50. Organizations using Extended Stable on Windows or Mac need version 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks; the Android release is expected on Google Play over the next few days.
The release notes describe CVE-2026-125350 as a “Use after free in XML” bug and rate it high severity. The issue was reported by an anonymous researcher on November 6, according to Google. The November 9 release also fixes a separate XML use-after-free flaw, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that the second flaw is being exploited.
To check Chrome on a computer, open the three-dot menu, select Help, then About Google Chrome. The browser checks for updates there; users must select Relaunch after installation for the update to take effect. On Android, check Chrome’s listing in Google Play and select Update if offered. Google’s notes say Android releases carry the same security fixes as their corresponding desktop releases unless otherwise stated.
Chrome and the 2026 XML Zero-Day: Which Version Do You Need?
Google says CVE-2026-125350 is being exploited in the wild. Install the version matched to your device and relaunch Chrome to apply the fix.
Choose your patched version
Use the version for your platform; Android’s release is Chrome 157.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 · 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update and restart
The desktop rollout is staged, so check again if the update is not offered yet.
Open the three-dot menu, choose Help, then About Google Chrome.
Let Chrome check for the update, then select Relaunch to apply it.
Find Chrome in Google Play and select Update if offered.
What is known—and not known
- Google rates the XML use-after-free flaw high severity.
- Google says an exploit exists in the wild.
- The issue was reported on November 6; the update was released November 9, 2026.
- Who is behind the exploitation or who was targeted.
- How the exploit works, when attacks began, or their scale.
- Whether iOS or ChromeOS is affected.
Other Chromium-based browsers
A Chrome update does not automatically patch other browsers; each vendor must issue its own release.
Desktop fix reported
Vivaldi said a desktop update included the fix.
Patched Chromium base
Brave listed a release built on the patched Chromium version.
Fix in progress
Microsoft said it was working on a security fix.
Verify vendor notices
No Opera post mentioning the flaw had been found in the supplied reporting.
Why the Chrome Patch Needs Attention
The company’s statement that an exploit is already being used in the wild makes this more urgent than a routine vulnerability disclosure. Google has not described the attacks, but the existence of exploitation means the flaw is not merely a theoretical risk. Installing the fixed version and restarting Chrome are practical steps users can take to receive the protection in this release.
The issue may also affect people who use Chromium-based browsers other than Chrome, but a Chrome update does not automatically patch those products. Each browser vendor must ship its own update. As of November 10, the supplied vendor information showed different statuses: Vivaldi said a desktop update included the fix, Brave listed a release built on the patched Chromium version, and Microsoft said it was working on a fix. Users should verify their own browser’s release notes rather than assume coverage.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet with Bluetooth and Color Touchscreen
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How the XML Flaw Was Reported
Google’s Chrome Stable Channel notes say the vulnerability was reported on Friday, November 6, and the patched release followed on Monday, November 9. The short interval between report and fix is the confirmed timeline; Google has not said when the exploitation began. The company’s release notes restrict technical details while the issue remains under active security handling.
A use-after-free is a memory-management error: software may release a section of memory and later attempt to use it again. In a browser, such a flaw can have serious consequences, but the precise outcome depends on the vulnerability and how it is exploited. Google has identified the affected area as its XML component but has not specified which part of XML handling is involved. The supplied reporting says the 2026 release notes contain eight Chrome flaws that Google described as exploited in the wild; that count is based on the releases reviewed by the source, not a measure of how many attacks occurred.
“Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.”
— Microsoft, Edge security release notes
Attack Details Remain Restricted
Google has not identified who is behind the exploitation, which users or organizations were targeted, or how the exploit works. It has also not stated when attacks began or provided information that would establish their scale. The restricted details mean the vulnerability’s practical impact cannot be assessed from the release notes alone.
The source material also reported no Chrome release-note entry mentioning this flaw for iOS or ChromeOS as of November 10. That does not establish whether those products are affected or unaffected. The status of other Chromium-based browsers may change as their vendors publish updates; the version information cited here reflects what had been published on that date.
Check for Vendor Security Releases
Chrome users should check that their installation has reached the appropriate fixed version and relaunch the browser after updating. Android users can check Google Play over the coming days as the release becomes available. Because Google’s desktop rollout is staged, a user who does not yet see the update can check again later.
Users of Edge, Vivaldi, Brave, Opera and other Chromium-based browsers should follow their browser maker’s security notices for a product-specific patched release. At the time covered by the source material, Microsoft had not listed a fixed Edge version, Vivaldi reported a fix in its desktop update, Brave had a release based on the patched Chromium version, and no Opera post mentioning the flaw had been found. Further vendor updates and any later technical disclosure from Google may clarify product coverage and the attack method.
Key Questions
Which Chrome version fixes CVE-2026-125350?
Windows and Mac: 157.0.8103.50 or .51. Linux: 157.0.8103.50. Android: Chrome 157, version 157.0.8103.50. Extended Stable users on Windows and Mac need 156.0.8078.96.
How do I install the Chrome update?
On a computer, open Chrome’s three-dot menu, choose Help, then About Google Chrome. Let Chrome check for and download the update, then select Relaunch. On Android, check Chrome in Google Play and tap Update if the option appears.
What does Google mean by an exploit in the wild?
Google says an exploit for the flaw exists in the wild, indicating that exploit code is being used. The company has not disclosed who is using it, who has been targeted or how the attacks work.
Are other Chromium-based browsers patched?
Not automatically. Browser makers issue their own updates. The source material reported that Vivaldi had a desktop update including the fix and Brave listed a release based on the patched Chromium version. Microsoft said it was working on an Edge fix; users should check their browser vendor’s latest release notes.
Is the separate XML flaw also being exploited?
Google’s November 9 release also fixes CVE-2026-125346, another XML use-after-free bug. Google did not say that this second flaw was being exploited in the information cited here.
Source: ThorstenMeyerAI.com
