🔍 Read the full analysis: Attackers Already Use Chrome’s XML Bug: Your Browser Update Checklist on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome updates on November 9, 2026, fixing a high-severity XML use-after-free flaw, CVE-2026-125350, that the company says is being exploited in the wild. Updates are rolling out across desktop and Android, while some Chromium-based browsers have separate release schedules. Google has not disclosed who is behind the attacks, who was targeted or how the exploit works.
Google released Chrome updates on November 9 that fix nine security flaws, including a high-severity XML bug the company says attackers are already exploiting. The affected vulnerability, CVE-2026-125350, makes installing the patched version promptly important for Chrome users, though Google says distribution will continue over the coming days and weeks.
In its security notice, Google said it was “aware that an exploit for CVE-2026-125350 exists in the wild.” The company classified the issue as a use-after-free flaw in Chrome’s XML component. The notice does not explain the exploit’s technical details or identify victims.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50 for Android, as patched releases. Windows and Mac users on Extended Stable should receive 156.0.8078.96. Google said desktop updates would roll out over the coming days or weeks, with Android availability through Google Play over the next few days.
The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second flaw is being exploited. The exploited bug was reported by an anonymous researcher on November 6, three days before Google published the fix.
To check Chrome on a computer, open the three-dot menu, choose Help, then About Google Chrome. Chrome checks for updates there; users need to select Relaunch after installation for the new version to take effect. On Android, check for an update in Google Play and find the installed version under Chrome’s Settings and About Chrome.
Chrome’s XML Bug Is Under Attack Your update checklist
Google says attackers are exploiting a high-severity Chrome flaw. Check for the patch, install it, and relaunch your browser.
What the patch addresses
CVE-2026-125350 is a high-severity use-after-free flaw in Chrome’s XML component.
Active exploitation confirmed
Google says an exploit exists in the wild, but has not disclosed its use or impact.
Another XML flaw
The update also fixes CVE-2026-125346; Google’s notes do not say it is being exploited.
Check and install the update
Updates are rolling out gradually, so check again later if the patch is not available yet.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Google Play.
Look for the update for your platform; Android updates are distributed through Google Play.
On desktop, select Relaunch after installation so the updated version takes effect.
Patch status depends on your browser
A Chrome release does not automatically update other Chromium-based browsers.
| Browser or platform | Reported status |
|---|---|
| Chrome desktop | Patch rolling out |
| Chrome Android | Update through Google Play |
| Edge | Microsoft was working on a fix |
| Vivaldi | Desktop fix reported |
| Brave | Listed release used patched Chromium; CVE not named |
| Opera | No desktop update mentioning the flaw found at the time |
What remains unknown
Google has confirmed exploitation but has not published the campaign’s details.
- Who is behind the attacks
- Who was targeted or how many attacks occurred
- How the exploit works or what it can achieve
- When more technical details will be released
Why the Chrome Patch Needs Attention
The company’s statement that an exploit is already being used distinguishes this release from a routine patch for a theoretical weakness. A browser bug can matter because browsers process web content, but Google has not said how attackers are delivering the exploit or what they can achieve with it. The exact risk to any individual user is not established by the public notice.
Google’s release notes list this as the eighth Chrome flaw in 2026 for which the company has said an exploit exists in the wild, according to the source’s count of Google’s posts. That is a count of reported vulnerabilities, not a measure of how many people were attacked or how widespread the activity was. For users, the practical step is to confirm the browser has updated and restarted rather than assume the update has reached every device automatically.
The fix also matters beyond Chrome itself. Chromium-based browsers use the same underlying project but depend on their own makers to ship updates. A Chrome patch does not, by itself, confirm that another browser is protected.
Products Worth Considering
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Jackery Explorer 300 Portable Power Station with SolarSaga 100W Solar Panel
Samsung Galaxy Tab A11+ 11-Inch Tablet, 6GB RAM, 128GB Storage, Expandable, Gray
As an affiliate, we earn on qualifying purchases.
A Three-Day Report-to-Fix Timeline
Google’s Chrome Stable Channel update says CVE-2026-125350 was reported anonymously on November 6 and fixed in the release published November 9. Google describes the bug as “Use after free in XML.” In general, a use-after-free error occurs when software uses memory after it has been released; the public notice does not specify the affected XML operation or confirm what an attacker can do with this particular flaw.
The source’s review of Google’s 2026 Chrome release notes counts eight exploited-in-the-wild flaws, including this one. It reports that four were in Chrome’s V8 JavaScript engine. The count provides a year-to-date tally from those notices; it does not establish that all flaws were used in the same campaigns or against the same targets.
Other browser makers had different update statuses on November 10. Microsoft said it was aware of the exploits and was working on a fix for Edge. Vivaldi’s desktop update was reported to include a fix, while Brave’s listed release used Chromium 157.0.8103.50 but did not mention this CVE in its release text. The source found no Opera desktop update mentioning the flaw at that time.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, Chrome security notice
Attack Details Remain Restricted
Google has not publicly identified who is behind the attacks, which people or organizations were targeted, how many attacks occurred, or how the exploit works. The company is keeping technical details restricted for now. The public notice confirms exploitation but does not establish the campaign’s scope or its effects.
Browser status also varies by platform and vendor. The source found no Chrome for iOS or ChromeOS release note mentioning this flaw as of November 10, and no fixed Edge version was listed in Microsoft’s notice at that time. Those observations describe the published information on that date; they do not establish whether later releases have since appeared.
Check for Vendor-Specific Releases
Chrome users should check their installed version, apply the update when it appears, and restart the browser to finish installing it. Because Google says the desktop release will roll out over days or weeks, users who do not yet see it can check again later. Android users should look in Google Play for the update.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should check that browser maker’s security notes and update channel. The supplied information does not give a confirmed fixed release for every product. Google has not provided a public timetable for releasing more details about the vulnerability or the attacks.
Key Questions
Which Chrome versions contain the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Extended Stable users on Windows and Mac should look for 156.0.8078.96.
How do I check whether Chrome is updated?
On desktop, open Chrome’s three-dot menu and choose Help, then About Google Chrome. Chrome checks for updates on that page. If it installs one, select Relaunch so the patched version is active. On Android, check Chrome in Google Play.
What does Google mean by exploited in the wild?
Google’s statement means the company is aware of an exploit for CVE-2026-125350 being used. It has not publicly said who used it, who was targeted, how widespread the activity was or what the exploit does.
Are other Chromium-based browsers patched?
Not necessarily at the same time as Chrome. Each browser maker distributes its own releases. As of November 10, the source reported that Vivaldi listed a fix, Microsoft was working on an Edge security fix, and the cited Brave release used the patched Chromium version without naming the CVE. Check your browser vendor’s latest notices.
Source: ThorstenMeyerAI.com
