Google updated the Chrome Stable channel on Nov 9, 2026 to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, fixing nine security flaws including CVE-2026-125350, a use-after-free in XML reported on Nov 6 [1]. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild, and Security NEXT reports seven of the nine fixed flaws are rated High [1][2]. Chrome users and IT teams should update desktop Chrome to 157.0.8103.50 or later now and, since the rollout takes days to weeks, check for the update manually and relaunch the browser [1].
Chrome 157 fixes exploited XML use-after-free zero-day CVE-2026-125350
1 min read
- Disclosed
- Nov 9, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
- 1%, higher than 62% of CVEs
- Exploitation and patch status
- ExploitedPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| Google Chrome | < 157.0.8103.50[1] | 157.0.8103.50/.51 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- CVE-2026-125350 reported to Google by an anonymous researcher[1]
- Google ships Chrome 157.0.8103.50/.51 and confirms in-the-wild exploit[1]
- iThome: Chrome for Android should also be updated to 157.0.8103.50[3]
iThome reports that Google urges users to apply the Chrome 157 update promptly: Windows and macOS users should update to 157.0.8103.50 or 157.0.8103.51, and Linux and Android users to 157.0.8103.50. The report notes Google has not disclosed how CVE-2026-125350 was exploited.
Technical details
Remediation
Vendor guidance
References
Official / primary2
- [1]
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
- [5]CISA2026-11-10Accessed 2026-11-10
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.