🔍 Read the full analysis: What To Do About Chrome’s XML Bug And 2026 Zero-Day on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google released Chrome security updates on November 9, 2026, including a fix for CVE-2026-125350, a high-severity use-after-free flaw in its XML component that Google says is being exploited in the wild. Users should update and restart Chrome; users of other Chromium-based browsers should check their vendor’s release notes because fixes may arrive separately.
Google released Chrome updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit for the bug exists in the wild, making prompt installation and a browser restart important for Chrome users, while users of other Chromium-based browsers need to check whether their own vendor has issued a fix.
Google’s Stable Channel release notes list nine security fixes in the update and describe CVE-2026-125350 as a “Use after free in XML”. The bug was reported anonymously on November 6, according to Google, and the fixed release followed three days later. Google has rated the flaw high severity. It has not disclosed the exploit’s technical details, and the release notes do not identify who is using it or who may have been targeted.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Windows and Mac users on the Extended Stable channel are directed to version 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks, while the Android version is expected on Google Play over the next few days.
To update on a computer, open Chrome’s three-dot menu, choose Help, then About Google Chrome, and install any offered update. Relaunch Chrome to complete the installation; downloading an update without restarting does not apply it. On Android, check Chrome’s Play Store listing for an Update option. Google’s release notes say Android releases carry the same security fixes as the corresponding desktop releases unless stated otherwise.
Chrome XML bug and 2026 zero-day
Google says an exploit for a high-severity Chrome flaw is being used in the wild. Install the update and restart Chrome; check other Chromium browser vendors for their own fixes.
What Google confirmed
CVE-2026-125350 is a high-severity use-after-free flaw in Chrome’s XML component.
Used in the wild
Google confirms an exploit exists, but has not described how it works or who was targeted.
Details are limited
The release notes do not establish the scale or success of attacks.
Get the Chrome fix
The update rolls out over the coming days or weeks, so availability can vary.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Chrome in Google Play.
Install the offered update and restart Chrome to complete it.
Check About Google Chrome after relaunch to confirm the installed version.
Check other browsers separately
Chromium-based browsers distribute fixes on their own schedules.
| Browser | November 10 source check |
|---|---|
| Vivaldi | Desktop update included the fix |
| Brave | Listed release used patched Chromium |
| Edge | Microsoft said a fix was in progress |
| Opera | No desktop update mentioning the flaw was found |
Why Restarting Chrome Matters
Google’s statement that an exploit is being used in the wild means the issue is not limited to a theoretical weakness: the company says attack code exists and is being used. The available information does not establish the scale or success of those attacks, but users who have not installed the fix remain on a version that lacks Google’s correction for this flaw.
A use-after-free bug occurs when software accesses memory after it has been released for reuse. Depending on how an issue is triggered and exploited, such memory errors can cause crashes or other harmful behavior. The Hacker News reported that use-after-free flaws can lead to data corruption, crashes or arbitrary code execution; that describes potential consequences generally, not a confirmed outcome for this specific Chrome bug. Google has not said how CVE-2026-125350 is exploited.
The update also matters beyond Chrome because several popular browsers use Chromium. Those browsers receive fixes on their own release schedules, so Chrome’s patched version does not by itself confirm that another browser is protected. Users should apply the update their browser maker has published rather than assume that the Chrome release covers them.
Popular right now
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
De'Longhi Magnifica Start Fully Automatic Espresso Machine with Milk Frother, Silver
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
A Third-Day Patch for Chrome
The bug’s reported timeline is short: Google’s release notes credit an anonymous report dated November 6, then publish the fix on November 9. Google says the update will roll out over the coming days or weeks, which means availability may vary by device. The update addresses a second XML use-after-free issue, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second flaw is being exploited.
The supplied source’s review of Google Chrome Releases posts counts this as the eighth Chrome flaw in 2026 for which Google has said an exploit exists in the wild. That count is based on the wording in Google’s release notes; it is not a measure of attack volume or the number of affected users. Four of the eight listed flaws were in Chrome’s V8 JavaScript engine, according to the review.
As of November 10, the source reports that Microsoft said it was working on an Edge security fix but had not listed a fixed version. It says Vivaldi’s desktop update moved to Chromium 156.0.8078.99 and included a fix for CVE-2026-125350, while Brave’s listed version 1.99.56 used Chromium 157.0.8103.50. The source found no Opera desktop update mentioning the flaw and no ChromeOS or iOS release note identifying it at that time. These are time-stamped checks, not confirmation of the current status of every browser release.
““Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.””
— Microsoft, Edge security release notes, as reported on November 10
Exploit Details Remain Restricted
Google has not explained how the exploit works, which part of XML handling is vulnerable, or what conditions an attacker would need to trigger the flaw. It has also not named the people or groups behind the activity, identified affected targets, or said how many attacks have occurred or whether they succeeded. Google is keeping further bug details restricted for now.
The available release notes confirm exploitation but do not establish that every Chrome user has been targeted or is at equal risk. The source’s November 10 checks also leave some browser and platform statuses unresolved: no ChromeOS or iOS post mentioning the bug had been found, and some Chromium-based vendors had not published a fix in the material reviewed. A lack of a cited update is not proof that no update exists; users should check the relevant vendor’s current release information.
Check Each Browser’s Patch Status
Chrome users should install the listed version for their operating system, then relaunch the browser and verify the version through About Google Chrome. Android users should check Google Play and confirm the installed version in Chrome’s settings. Because Google says the rollout may take days or weeks, users whose browser does not yet offer the update should check again for availability.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should consult that browser maker’s security notes and install its update when available. As of the source’s November 10 check, Microsoft had said it was working on an Edge fix; Vivaldi had reported including one, and Brave had listed a release based on the patched Chromium version. Those details may change as vendors publish updates. Further information about the exploit and any affected targets remains dependent on Google or other relevant parties providing more detail.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit exists in the wild, but has not publicly detailed how it works.
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac on Extended Stable.
How do I apply the Chrome update?
On desktop, go to the three-dot menu, select Help, then About Google Chrome. Install the update if offered and relaunch Chrome. On Android, check for an update in Google Play.
Are other Chromium-based browsers already fixed?
Not necessarily. Each browser maker distributes its own updates. The source’s November 10 review reported a Vivaldi fix and a Brave release based on patched Chromium, while Microsoft said it was working on an Edge fix. Check your vendor’s current release notes.
What is known about the attacks?
Google has confirmed that an exploit exists in the wild. It has not disclosed who is behind the attacks, who was targeted, how the exploit works or how many incidents have occurred.
Source: ThorstenMeyerAI.com
