On 9 November Google released an emergency Chrome update fixing CVE-2026-125350, a flaw in the XML component that is already being exploited in attacks. It affects any company whose staff use Chrome on Windows, macOS or Linux. Update today to version 157.0.8103.50 or later and restart the browser.
Key facts
- CVE-2026-125350 is a high-severity use-after-free flaw in Chrome's XML component. Exploiting it can lead to data corruption, crashes or arbitrary code execution (Chrome Releases).
- Google says it is aware that an exploit exists in the wild. An anonymous researcher reported the flaw on 6 November.
- Fixed versions: 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. The rollout is gradual over the coming days (BleepingComputer).
- The update fixes nine vulnerabilities: besides the zero-day, six high-severity flaws (WebGL, FileSystem, Compositing, GPU, V8 and XML) and two medium-severity ones in the GPU (SecurityWeek).
- It is the eighth exploited Chrome zero-day of 2026. The Hacker News lists the CVSS as "N/A", and CISA had not yet added it to its KEV catalogue when the advisory was published.
Does this affect us if we use Chrome?
Yes, if your staff use Chrome on Windows, macOS or Linux and are not yet on version 157.0.8103.50 or later. An exploited browser zero-day can be triggered just by visiting a website or opening malicious content.
Google has not shared details about the attacks or who is behind them. That does not lower the risk: it only means you don't know whether your sector is a target. For a business, the typical damage is stolen sessions and credentials for email, the ERP or online banking from a compromised laptop.
Why not just wait for Chrome to update itself?
Because Google rolls out the fixed version gradually over the following days, so some machines will get it late. And the patch doesn't protect anyone until the browser restarts, which many people put off. The good news: BleepingComputer found the update available immediately when checking manually. Forcing it works.
The other blind spot is the machines nobody checks: the design team's Mac, the engineering team's Linux laptop or the home computer someone uses for remote work.
What to do today
- Ask your staff, or your IT provider, to open Chrome > Help > About Google Chrome and click Relaunch once the download finishes.
- Check in your management console or inventory that every machine is on 157.0.8103.50 or later. Don't assume the automatic rollout has already arrived.
- Review the Chrome machines that usually slip through: macOS, Linux and remote-work devices.
- If you use deferred update policies, bring them forward this week.
- Also check any Chromium-based browsers you use. The sources consulted only confirm the fix in Chrome, so check whether each vendor has released its own update.
What it means for a small business
Eight exploited Chrome zero-days so far this year. This is not an isolated event, it's the normal pace. The practical takeaway for a company of 10 to 200 people is that the browser is now the front door to your email, ERP and bank, and it needs to be managed that way.
That doesn't take a big budget. It takes knowing how many machines you have, which Chrome version they run and who is responsible for forcing a restart when an urgent patch lands. If you can't answer those three questions in ten minutes today, that is the underlying problem, beyond this CVE.
Don't wait for CISA to add it to the KEV catalogue or for a CVSS score before acting either. The fact that matters is already on the table: Google confirms an exploit is in the wild. If you want an inventory and patching policy that doesn't depend on anyone's memory, you can see how we approach it in our cybersecurity service.
Frequently asked questions
Is Chrome's automatic update enough?
Not entirely. The rollout is gradual and the patch doesn't protect you until the browser restarts. Force the update from Help > About Google Chrome.
Does it affect other Chromium-based browsers?
The sources consulted only confirm the fix in Chrome. Check whether the vendor of each browser you use has released its own update.
Do we know who is behind the attacks?
No. Google has not shared details about the attacks or who is carrying them out.
Sources
- Chrome Releases (Google) – Stable Channel Update for Desktop, 9 November 2026
- BleepingComputer – Google patches eighth Chrome zero-day exploited in attacks this year
- The Hacker News – Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
- SecurityWeek – Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
