Chrome Zero-Day CVE-2026-125350 Exploited: Update Chrome to 157.0.8103.50 Now
Google has patched an actively exploited Chrome zero-day, CVE-2026-125350, in Chrome 157.0.8103.50. Here is what it is, how to update now and what Edge users should do.
Image: TeQBlogs
Google has fixed a Chrome zero-day, CVE-2026-125350, that attackers are already exploiting. The fix is in Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, released on 9 November 2026. Open Chrome’s About page, let it download the update and click Relaunch now, because the automatic rollout can take days or weeks to reach every PC.
Quick summary
| Exploited bug | CVE-2026-125350, use after free in XML (High) |
| Exploited in the wild? | Yes. Google says it is aware that an exploit exists |
| Total fixes in this update | 9 security fixes (7 High, 2 Medium) |
| Fixed Chrome versions | 157.0.8103.50/.51 (Windows, Mac), 157.0.8103.50 (Linux), Extended Stable 156.0.8078.96 (Windows, Mac) |
| Released | 9 November 2026 |
| Microsoft Edge | Microsoft says it is working on a fix (9 November 2026) |
| What to do | Menu > Help > About Google Chrome > Relaunch |
What is the Chrome zero-day CVE-2026-125350?
CVE-2026-125350 is a “use after free” memory bug in the part of Chrome that handles XML. Google rates it High. It was reported anonymously on 6 November 2026, and Google shipped the fix just three days later. That speed is typical when a flaw is being used in real attacks.
A use-after-free bug happens when a program keeps using a piece of memory after it has released it. In a browser, an attacker can sometimes shape that memory with a booby-trapped web page and use the bug to run their own code. Google has not said who is using the exploit, who is being targeted or what the attack chain looks like. It usually keeps those details private until most users have updated, and its release note says bug details “may be kept restricted” for that reason.
Also read: Zyxel GS1900 Vulnerability: Install Patch 3 Now to Stop Root Attacks
This is a separate release from the big Chrome 157 update of 3 November, which fixed 213 bugs but had no known exploits. If you followed our Chrome 157 update guide last week, you still need this newer build.
All 9 security fixes in Chrome 157.0.8103.50
Google’s 9 November release note lists nine security fixes. Only CVE-2026-125350 is marked as exploited, but several others are High-severity memory bugs, so the whole update matters.
| CVE | Severity | Component and bug type |
|---|---|---|
| CVE-2026-125350 | High | Use after free in XML (exploited in the wild) |
| CVE-2026-125346 | High | Use after free in XML |
| CVE-2026-125345 | High | Uninitialized resource in WebGL |
| CVE-2026-125347 | High | Incorrect authorization in FileSystem |
| CVE-2026-125343 | High | Buffer overflow in Compositing |
| CVE-2026-125348 | High | Out of bounds write in GPU |
| CVE-2026-125344 | High | Type confusion in V8 |
| CVE-2026-125349 | Medium | Uninitialized resource in GPU |
| CVE-2026-125342 | Medium | Uninitialized resource in GPU |
How to update Chrome to fix the zero-day
Updating takes about a minute on a normal connection. Chrome reopens your tabs after the restart, but save any work typed into web forms first.
- Open Chrome on your computer.
- Click the three-dot menu at the top right.
- Go to Help > About Google Chrome. Chrome checks for updates and starts downloading.
- When the download finishes, click Relaunch.
- Open the About page again and confirm the version is 157.0.8103.50 or later (157.0.8103.51 is also fine on Windows and Mac).
On Android: Google released Chrome 157.0.8103.50 for Android on the same day and says it will reach Google Play over the next few days. Its Android note mentions only stability and performance fixes, but it is still worth installing. Open the Play Store, search for Chrome and tap Update if it shows.
Extended Stable users: companies that stay on Chrome’s slower Extended Stable channel get the fix in version 156.0.8078.96 for Windows and Mac, which Google’s note shows includes CVE-2026-125350.
Is Microsoft Edge affected?
Edge is built on the same Chromium code, and Microsoft is treating it as affected. On 9 November 2026 its Edge security release notes said: “Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.” No fixed Edge desktop version had been listed at the time of writing.
- Keep Edge open on Settings > About Microsoft Edge over the next day or two so it installs the fix as soon as Microsoft ships it.
- Until then, avoid opening links from unknown emails, WhatsApp forwards or SMS in Edge. Use an updated Chrome instead for unfamiliar sites.
- Other Chromium browsers such as Brave, Opera and Vivaldi depend on their makers to ship the fix. Check each browser’s About page and update as soon as a new version appears.
What businesses in India should do now
Browsers are the most-used app on almost every office PC, which makes an exploited Chrome bug a priority patch. Waiting for the gradual rollout leaves a gap of days or more.
- Push Chrome 157.0.8103.50/.51 (or Extended Stable 156.0.8078.96) through your management tool today, rather than waiting for auto-update.
- Ask staff to click Relaunch when Chrome shows the update prompt. A downloaded update does nothing until the browser restarts.
- Track Microsoft’s Edge security notes and deploy the Edge fix as soon as it is released.
- Check shared and kiosk PCs, which are often left with Chrome open for weeks.
- Re-check versions after 48 hours to catch machines that missed the update.
If your team does not have a routine for browser and OS patching, a managed cybersecurity service can take that work off your plate. For phones, our guide to the Android November security update covers the other patch you should install this month.
Frequently asked questions
Which Chrome version fixes CVE-2026-125350?
Chrome 157.0.8103.50 or 157.0.8103.51 on Windows and Mac, and 157.0.8103.50 on Linux. On the Extended Stable channel, the fix is in 156.0.8078.96.
Is the Chrome zero-day being used in attacks?
Yes. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild. It has not shared details about the attackers or targets.
Does Chrome update itself automatically?
Yes, but Google rolls updates out over days or weeks, and the fix only applies after Chrome restarts. Opening Help > About Google Chrome and clicking Relaunch applies it immediately.
Is Microsoft Edge safe to use right now?
Microsoft said on 9 November 2026 that it is working on a fix for the exploited bug. Until a fixed Edge version is out, be careful with unknown links and check Edge’s About page for updates.
Bottom line
This Chrome zero-day is already being exploited, and the fix is ready. Update Chrome to 157.0.8103.50 or later and relaunch it today, update Chrome on Android when Play Store offers it, and install Microsoft’s Edge fix the moment it arrives. For more ways to keep your devices patched, see our Security section.
Sources
- Google Chrome Releases: Stable Channel Update for Desktop (9 November 2026)
- Google Chrome Releases: Extended Stable Update for Desktop (9 November 2026)
- Google Chrome Releases: Chrome for Android Update
- Microsoft Learn: Release notes for Microsoft Edge Security Updates
About The Author
