🔍 Read the full analysis: Is Chrome’s XML Bug Being Used By Attackers? Here’s The Version To Get on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9, 2026, including a fix for CVE-2026-125350, a high-severity XML use-after-free flaw that Google says is being exploited in the wild. Users should update to the listed version for their platform and relaunch Chrome; users of other Chromium-based browsers should check their vendor’s release notes.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in the browser’s XML component. Google said an exploit for the bug exists in the wild, meaning attackers are using it, but has not disclosed who is behind the activity or whom it targets.
Google’s release notes list nine security fixes in the update. The XML flaw was reported by an anonymous researcher on Friday, November 6, and the fix was released the following Monday. Google rates CVE-2026-125350 “High” and is restricting technical details while the issue is being addressed.
Google lists the fixed versions as 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using the Extended Stable channel should use 156.0.8078.96 for Windows and Mac. Google says the desktop update will roll out over the coming days or weeks, and the Android release will become available through Google Play over the next few days.
On a computer, users can open Chrome’s three-dot menu, select Help, then About Google Chrome, and install any offered update. Chrome must be relaunched for the update to take effect. Android users can check for Chrome in Google Play; the installed version is also shown in Chrome’s Settings under About Chrome.
Chrome’s XML bug is being exploited Update and relaunch
Google says attackers are using a high-severity Chrome flaw. Install the fix for your platform and relaunch Chrome to apply it.
What the notice confirms
Google confirms an exploit exists in the wild, but has restricted technical details.
- The flaw is a high-severity use-after-free in Chrome’s XML component.
- Google says attackers are using an exploit.
- Who is behind the activity or whom they target.
- How the exploit works or how many users are affected.
Get the update
The fix is rolling out gradually; check again if it is not available yet.
On desktop, open the three-dot menu, then Help and About Google Chrome. On Android, check Google Play.
Use the fixed version listed for your platform. Extended Stable users should confirm their Windows or Mac version.
Restart the browser to complete applying the desktop update.
Other Chromium browsers
Each browser maker ships its own release, so Chrome’s update does not automatically cover other browsers.
- Check the vendor’s release notes and update process.
- Edge, Brave, Vivaldi, Opera, and other Chromium-based browsers may have different patch timing.
- Vendor statuses reported on November 10 were a snapshot and may have changed.
Why the Chrome fix needs attention
The security notice indicates that working attack code is already in use, while a patch is being distributed gradually. Updating and restarting Chrome applies the fix on supported platforms; simply downloading an update without relaunching does not complete that step.
The issue may also affect people who use browsers built on Chromium, the open-source project behind Chrome. Those browsers do not necessarily receive Google’s update at the same time: each vendor must ship its own release. On November 10, the supplied source reported that Microsoft Edge had not yet listed a fixed version, while Vivaldi had announced a release containing a fix and Brave had listed a release based on the patched Chromium version. Users should verify their browser’s status with its maker rather than assume that a Chrome update covers it.
The source’s review of Google’s 2026 release notes counted this as the eighth Chrome flaw Google had flagged as exploited in the wild this year. That count describes Google’s notices, not the total number of attacks or the number of affected users. It offers a reason to treat the current update as a prompt to check browser updates, without implying that every Chrome user has been targeted.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 256GB SSD, Liquid Retina Display, and 1080p Camera — Blush
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
How the XML flaw was reported
Google describes CVE-2026-125350 as a “Use after free in XML”. A use-after-free error occurs when software continues to use memory after it has been released. Depending on the circumstances, such errors can cause crashes or memory corruption and may allow more serious exploitation. The Hacker News, as cited in the source material, noted those potential outcomes generally; Google has not described how this particular exploit works or confirmed what it can do.
XML is a format for structured data that browsers handle in several settings, including SVG graphics and XML documents. Google has not said which part of Chrome’s XML handling is affected. The same update also fixes a second XML use-after-free flaw, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that the second flaw is being exploited.
Google’s release notes give the report date for CVE-2026-125350 as November 6 and say the desktop fix was published November 9. The source’s author counted eight exploited-in-the-wild Chrome flaws from Google’s 2026 notices; that figure is based on those release notes and is not a measure of attacks’ scale.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack details remain restricted
Google has not identified who is behind the attacks, their targets, or how the exploit works. The company has restricted technical details, so it is not possible from the available information to assess the attack’s reach or say what an attacker can achieve through this specific bug.
The source material reported no Chrome for iOS or ChromeOS release note mentioning the flaw as of November 10. That does not establish whether those platforms are affected or when a fix may be available. The status can change as vendors publish updates, particularly for Chromium-based browsers. Google’s “in the wild” statement confirms exploitation, but does not provide a count of incidents or affected users.
Check for vendor-specific patches
Chrome users should check for the version listed for their platform, install it when available, and relaunch the browser. Android users should check Google Play as the update rolls out. Organizations on Extended Stable should confirm they are using version 156.0.8078.96 for Windows or Mac.
People using Edge, Brave, Vivaldi, Opera, or another Chromium-based browser should follow that browser maker’s release notes and update process. The source reported different vendor statuses on November 10, so those details are a snapshot, not a current guarantee. Further vendor releases and Google’s platform-specific notices will clarify availability for browsers and operating systems not covered in the listed Chrome updates.
Key Questions
Which Chrome version fixes CVE-2026-125350?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac users on Extended Stable.
Is Google confirming that attackers are using the bug?
Yes. Google’s release notes say an exploit for CVE-2026-125350 exists in the wild. The company has not disclosed the attackers, targets, or technical details.
How do I install the Chrome update?
On desktop, open Chrome’s menu, choose Help, then About Google Chrome. Install the update and select Relaunch. On Android, check for Chrome in Google Play. The update must be applied and the browser restarted to take effect.
Are other Chromium-based browsers patched?
Not necessarily at the same time as Chrome. Each vendor distributes its own browser updates. Check the maker’s release notes and do not assume a Chrome patch also updated Edge, Brave, Vivaldi, Opera, or another Chromium-based browser.
What is still unknown about the exploit?
Google has not said who is using the exploit, whom they are targeting, or how it works. It has also not provided an estimate of the number of attacks or affected users.
Source: ThorstenMeyerAI.com
