🔍 Read the full analysis: Chrome’s Eighth Zero-Day This Year: The XML Bug And Your Next Update on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google released Chrome updates on November 9 for nine security issues, including high-severity XML bug CVE-2026-125350, which the company says is being exploited. Google’s release notes list this as the eighth Chrome flaw in 2026 for which it has reported exploitation in the wild; users should check for and install the version for their platform.
Google released Chrome security updates on Monday, November 9, fixing nine security issues, including a high-severity XML use-after-free bug that the company says is being exploited in the wild. Google’s release notes identify the flaw as CVE-2026-125350; it is the eighth Chrome vulnerability this year for which Google has flagged active exploitation, according to a count of the company’s 2026 notes.
Google’s desktop release notes say the vulnerability was reported by an anonymous researcher on Friday, November 6, and describe it as “Use after free in XML.” The company has not published technical details about the affected XML component or how the exploit works. Google rated the flaw High and said it is aware of an exploit “in the wild,” indicating that exploitation is known to the company, but not who is responsible or which users or organizations may have been targeted.
The listed fixed versions are Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Google also lists 156.0.8078.96 for Windows and Mac on its Extended Stable channel. The company says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days. Users can open Chrome’s menu, select Help, then About Google Chrome to check for an update; Chrome must be relaunched for an installed update to take effect.
The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second issue is being exploited. The release includes nine security fixes overall, but the source material does not provide details on all of them.
Chrome’s XML Zero-Day Check for your update
Google says attackers are exploiting a high-severity Chrome flaw. Check your browser’s version and restart it after updating.
What the flaw means
Google describes CVE-2026-125350 as a high-severity use-after-free bug in XML. It has not disclosed how the exploit works.
Check and restart
An installed update takes effect after Chrome is relaunched.
Verify deployment
The desktop rollout may take days or weeks, so check versions across managed devices.
Check each vendor
A Chrome fix does not automatically update other Chromium-based browsers.
Get the Chrome fix
Google lists these fixed versions for the platforms in its release notes.
Windows and Mac: 157.0.8103.50/.51; Linux and Android: 157.0.8103.50. Extended Stable for Windows and Mac: 156.0.8078.96.
On desktop, open Help, then About Google Chrome. Android users can check Google Play.
Restart the browser so the installed update takes effect.
What is known and unknown
The exploitation claim comes from Google’s release notes; details about attacks remain limited.
- The XML flaw is high severity.
- An exploit exists in the wild.
- The November update fixes nine security issues.
- Who is responsible or targeted.
- How the exploit works or how widespread it is.
- When every platform or other browser will be updated.
Check beyond Chrome
The source’s vendor checks reflect information available on November 10, 2026.
- Check your browser vendor’s release notes and update mechanism.
- As of November 10, Vivaldi had published a desktop update containing the fix; Edge had acknowledged exploitation and was working on a fix.
- The supplied source did not identify a Chrome iOS or ChromeOS release note for this flaw.
Why the Exploited XML Flaw Matters
The immediate concern is the reported exploitation before a fix was available. A use-after-free bug occurs when software reuses memory after it has been released; depending on the circumstances, such flaws can cause crashes or data corruption and may allow code execution. That describes potential outcomes of the bug class, not a confirmed account of what this Chrome exploit does. Google has not said how the current vulnerability is being used.
For users, the practical takeaway is to check that Chrome has reached a fixed version and restart the browser after updating. For organizations, the staggered rollout means some managed devices may not receive the update immediately. Administrators should verify versions across their fleets and follow their browser vendor’s guidance rather than assume an update has arrived automatically.
The issue may also affect users of other Chromium-based browsers, but a Chrome fix does not automatically update those products. Their developers need to incorporate and distribute the relevant fix. As of November 10, the supplied source reports that Microsoft Edge had acknowledged the in-the-wild exploitation and was working on a fix, while Vivaldi had published a desktop update containing the fix. It listed a Brave release based on the fixed Chromium version, but did not say the release notes explicitly named this CVE. It found no Opera update mentioning the flaw at that time.
Popular right now
De'Longhi Magnifica Start Fully Automatic Espresso Machine with Milk Frother, Silver
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Breville Barista Express Espresso Machine with Built-In Grinder, Black Sesame
As an affiliate, we earn on qualifying purchases.
How the Eighth Exploited Flaw Fits
The count of eight refers to vulnerabilities Google’s Chrome release notes have flagged as exploited in the wild during 2026, not to all Chrome security bugs found this year or a measure of attack volume. The source’s review of Google’s notes lists earlier entries in February, March, June and September, followed by CVE-2026-125350 in November. SecurityWeek, The Hacker News and BleepingComputer are also reported to have counted the same eight flaws.
The source says four of the eight were in V8, Chrome’s JavaScript engine; the current issue is described as being in XML handling. Google’s release notes do not identify the specific XML functionality affected. Browsers process XML in different contexts, including some documents and graphics, but that general fact does not establish where this vulnerability can be triggered.
Google’s stated rollout windows matter because the November 9 publication does not mean every device was patched at once. As of November 10, the versions above were the fixes Google listed. The source found no Chrome for iOS or ChromeOS release note mentioning this flaw at that time, so users of those products should consult subsequent official updates rather than assume their status.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
What Google Has Not Disclosed
Google has not said who is behind the exploitation, who was targeted, how widespread the activity is, or what steps an attacker must take to trigger the flaw. The company is keeping technical details restricted for now, according to the source material. The known exploitation claim comes from Google’s release notes; the available information does not independently establish the scope or impact of attacks.
It is also unclear when every Chrome installation will receive the update and when each Chromium-based browser vendor will ship a corresponding fix. The source’s vendor checks reflect information available on November 10, 2026, and may have changed since then. No status for Chrome on iOS or ChromeOS was identified in the reviewed release notes at that time.
Check for Platform-Specific Fixes
Chrome users should check the version listed for their operating system and install the update when it becomes available. On desktop, go to the three-dot menu, choose Help and About Google Chrome, then relaunch if prompted. Android users can check Google Play for Chrome updates and view the installed version under Chrome’s Settings and About Chrome.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should check that browser’s own release notes and update mechanism. Google’s Chrome release does not confirm that a separate browser has been patched. Organizations should track vendor advisories and verify deployment, especially while Google’s rollout remains in progress.
Google may publish more technical information after more users have installed fixes, but no disclosure date is given in the supplied material. Until then, the next concrete milestones are the arrival of updates on remaining platforms and announcements from other browser vendors.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free bug in Chrome’s XML component. Google says it is aware of an exploit in the wild but has not publicly explained how the flaw is triggered or used.
Which Chrome versions include the fix?
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac on Extended Stable. Check Google’s current release notes for later version changes.
Does installing the update protect me immediately?
Chrome must be restarted for an installed update to take effect. Google said the desktop release would roll out over coming days or weeks, so check About Google Chrome to see whether the fixed version is available.
Are other Chromium-based browsers already fixed?
Not necessarily. Each browser vendor distributes its own updates. The source’s November 10 check reported a Vivaldi desktop update containing the fix and a Brave release based on the fixed Chromium version; Microsoft said it was working on an Edge fix. Check your browser vendor’s latest advisory.
Source: ThorstenMeyerAI.com
