Chrome zero-day in XML is being exploited, update now
- chrome
- zero-day
- browser
- cve-2026-125350
Google's 9 November Chrome update fixes nine bugs, including CVE-2026-125350, a use-after-free in XML that Google says is exploited in the wild. Update to Chrome 157.0.8103.50 (Linux) or 157.0.8103.50/.51 (Windows, Mac) and relaunch.
On 9 November 2026 Google released a Chrome Stable update for Windows, Mac and Linux that fixes nine security bugs, seven rated High and two Medium. One of them, CVE-2026-125350, a use-after-free in Chrome's XML component, is already being used in attacks: Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." Anyone running desktop Chrome older than 157.0.8103.50 on Linux, or older than 157.0.8103.50/.51 on Windows and Mac, is affected. Google has not shared details of the attacks or the bug, and says bug details may stay restricted until most users have updated.
The bugs
CVE-2026-125350, use after free in XML (High, exploited). Reported anonymously on 6 November 2026. This is the bug Google says has an exploit in the wild. Google has not published a technical description.
CVE-2026-125346, use after free in XML (High). A separate XML bug, reported by Arni Hardarson (Neonix Security) on 12 October 2026.
CVE-2026-125344, type confusion in V8 (High). A flaw in Chrome's JavaScript engine, found by Google.
CVE-2026-125343, buffer overflow in Compositing (High). Found by Google.
CVE-2026-125348, out of bounds write in GPU (High). Found by Google.
CVE-2026-125345, uninitialized resource in WebGL (High). Found by Google.
CVE-2026-125347, incorrect authorization in FileSystem (High). Found by Google.
CVE-2026-125349 and CVE-2026-125342, uninitialized resource in GPU (Medium). Two lower-rated GPU bugs, one found by Google and one reported by Vo Duc Thang (ugvxb).
The remedy
A fix is available. Updating is the complete fix: move to Chrome 157.0.8103.50 or later on Linux, or 157.0.8103.50/.51 or later on Windows and Mac. Google says the update rolls out over the coming days and weeks, so do not assume a machine already has it. To check and apply it, open Chrome's menu, go to Help, then About Google Chrome, let it download the update, and relaunch the browser. The fix is not active until Chrome restarts. Managed fleets should confirm the installed version on each endpoint rather than relying on automatic updates. Other browsers built on Chromium need their own vendor's update, so check with that vendor.
If you cannot update today
No setting makes an unpatched system safe. Google's advisory lists no workaround or temporary mitigation, so updating and relaunching Chrome is the only remedy it offers.