TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google released Chrome updates on November 9, 2026, fixing a high-severity XML use-after-free vulnerability that it says is being exploited. Fixed versions vary by platform, and Chromium-based browser makers may ship their own updates on different schedules.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit for the bug exists in the wild, meaning attacks using it have been reported, though the company has not disclosed who is responsible or who may have been targeted.
Google’s Stable Channel update lists the vulnerability as “Use after free in XML” and rates it High severity. The company’s statement that an exploit exists in the wild confirms active exploitation, but Google has restricted technical details while the issue is being addressed. The update fixes nine security issues in total, according to the supplied release information.
Google lists version 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Businesses using Extended Stable on Windows or Mac are directed to version 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks; the Android release is expected on Google Play over the next few days.
The bug was reported by an anonymous researcher on November 6, according to Google’s release notes. The company published the fix three days later. The same update also addresses another XML use-after-free, CVE-2026-125346, which Google says was reported by Arni Hardarson of Neonix Security on October 12. The supplied material does not say that the second bug is being exploited.
To check Chrome on desktop, open the three-dot menu, select Help, then About Google Chrome. Chrome checks for an update on that page; after it downloads, select Relaunch to apply it. On Android, check Chrome’s listing in Google Play for an Update button. Chrome’s version appears under Settings and About Chrome.
Updates Across Chrome and Chromium Browsers
The confirmed in-the-wild exploitation makes this update time-sensitive for people who use affected Chrome versions. Google has not described the attacks or their reach, so the disclosure does not establish how many users are at risk. Installing the relevant fix closes the vulnerability addressed in this release once the browser restarts.
People using another browser built on Chromium should check that browser maker’s release notes. Chromium-based products do not necessarily receive a Chrome fix at the same time: each vendor must publish and distribute its own update. As of November 10, the supplied source reports that Microsoft Edge had not yet listed a fixed version, while Vivaldi and Brave had published releases based on fixed Chromium versions. Opera had no update mentioning the flaw in its desktop blog.
The source says this was the eighth Chrome flaw in 2026 for which Google had stated that an exploit existed in the wild, based on a count of Google’s release notes. That figure describes vulnerabilities flagged by Google in those notes; it does not measure attacks, affected users or the severity of this particular incident.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
As an affiliate, we earn on qualifying purchases.
How the XML Flaw Was Reported
A use-after-free is a memory-handling error: software uses a section of memory after it has been released for other use. Depending on the circumstances, such bugs can cause crashes or data corruption, and may sometimes be used to execute code. The Hacker News described those as possible outcomes of this class of vulnerability; the available information does not establish what attackers achieved with this specific flaw.
XML is a format for structured data that browsers handle in several settings, including XML documents and SVG graphics. Google has not identified the specific part of Chrome’s XML processing that is affected. It has also not published details of how an exploit works, limiting what can responsibly be said about the attack beyond the confirmed in-the-wild status.
Google’s update notes provide the reported date and fixed versions. The source material also says its count of eight exploited Chrome flaws this year was consistent with reporting by SecurityWeek, The Hacker News and BleepingComputer. No additional details from those outlets are provided here.
““Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.””
— Microsoft, Edge security release notes, November 9
Attack Details Remain Restricted
Google has not identified the attackers, the people or organizations targeted, or how the exploit works. The company has kept technical details restricted, and the supplied material does not say whether attacks require a particular user action or configuration. The scope and impact of exploitation are also unknown.
As of November 10, the supplied source found no ChromeOS or Chrome for iOS release note mentioning this vulnerability. That does not confirm whether those products are affected or when a fix may appear. Browser version status can also change after the source’s check, particularly for vendors that distribute their own Chromium-based updates.
Check for Vendor Updates
Chrome users should check their installed version, apply the update listed for their platform and relaunch the browser. Google says the rollout will take days or weeks on desktop and a few days on Android, so a fix may not appear immediately for every user.
Users of Edge, Vivaldi, Brave, Opera and other Chromium-based browsers should follow their vendor’s release notes for a version that includes the fix. The supplied information does not give a release date for Edge’s patch or establish the update status of every Chromium-based browser. Google may provide further technical details later, but no timetable for such disclosure is stated.
Key Questions
Is the Chrome XML bug being exploited?
Google says an exploit exists in the wild. It has not provided details about the attacks or identified those behind them.
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
Does updating Chrome update Edge or Brave too?
No. Chromium-based browsers receive updates from their own vendors. Check the browser maker’s release notes and installed version for confirmation that the fix is included.
What is not known about the attacks?
Google has not disclosed who is behind the attacks, who was targeted or how the exploit works. The source material also does not establish the attacks’ scale or impact.
Source: Thorsten Meyer AI
