TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Google released Chrome updates on November 9 that fix a high-severity use-after-free bug in its XML component. Google says an exploit exists in the wild; attackers, targets and technical details have not been disclosed. Update Chrome and check other Chromium-based browsers with their vendors.
Google released Chrome security updates on November 9 to fix a high-severity use-after-free bug in the browser’s XML component, and says an exploit for the flaw exists in the wild. The disclosure means attacks are already being reported, though Google has not said who is behind them, who may be targeted or how the exploit works.
The flaw is tracked as CVE-2026-125350. Google described it as “Use after free in XML” and rated it high severity. The company’s release note states: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” That is the clearest public information about the attacks so far; the note does not describe their scope or impact.
Google lists Chrome 157.0.8103.50 or .51 for Windows and Mac, and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. Businesses using the Extended Stable channel should look for 156.0.8078.96 on Windows and Mac. Google says desktop updates will roll out over the coming days or weeks, while the Android release will become available through Google Play over the next few days.
Google’s desktop notes say an anonymous researcher reported the bug on November 6, three days before the fix was released. The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that the second flaw is being exploited. The November 9 release lists nine security fixes in total.
Why an In-the-Wild Bug Matters
A bug already being exploited gives Chrome users a practical reason to check for the update rather than wait for it to arrive automatically. A browser is used to open web pages and other content, so a vulnerability in its handling of data can affect users as they browse. Google has not published enough technical detail to establish what an attacker must do to exploit this flaw or what a successful attack could achieve.
The bug is a use-after-free memory error: software may attempt to use memory after it has been released. Such errors can cause crashes or data corruption and, in some cases, may allow code execution. The Hacker News described those as potential outcomes of this class of bug; Google has not confirmed a specific outcome for CVE-2026-125350. The distinction matters: the existence of exploitation is Google’s stated assessment, while the method and consequences remain undisclosed.
The update also matters beyond Chrome because several other browsers use Chromium, the open-source project on which Chrome is based. Those browsers need their own vendors to ship and distribute fixes. A current Chrome release does not establish that a separate Chromium-based browser has been updated.
Products Worth Considering
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Bose Smart Soundbar 700 with Alexa, Black
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Chrome
Google’s release note identifies the affected area only as Chrome’s XML component. XML is a format for structured data, and browsers process XML in different settings, including some graphics and documents. Google has not identified the specific feature or content involved in this bug, so users should not infer a particular attack route from the component name alone.
Google’s own 2026 release notes have now flagged eight Chrome flaws as exploited in the wild, according to the source’s count of those posts. SecurityWeek, The Hacker News and BleepingComputer have reported the same count. That is a count of disclosed flaws, not a measure of how many people or devices were affected.
Other browser makers had different update statuses as of November 10. Microsoft said it was aware of recent exploits and was working on an Edge security fix, but had not listed a fixed version. Vivaldi said its desktop update based on Chromium 156.0.8078.99 includes a fix for CVE-2026-125350. Brave listed release 1.99.56, based on Chromium 157.0.8103.50, though its release text did not mention the CVE. The source found no Opera desktop post mentioning the flaw at that time.
““Use after free in XML.””
— Google, describing CVE-2026-125350
What Attack Details Are Missing
Google has not named the people or group behind the exploitation, identified any victims or described how the flaw is used. It has also not published the affected code path or a technical account of the vulnerability. The public information therefore does not establish whether attacks are targeted or widespread, or what an attacker can do after exploiting the bug.
Update availability also varies by product and platform. Google says its Chrome releases roll out over time, and browser vendors set their own release schedules. As of November 10, the source found no Google Chrome for iOS or ChromeOS release note mentioning this flaw. That does not establish whether those products are affected or when an update may appear.
Check for Browser Updates
On desktop Chrome, open the three-dot menu, choose Help, then About Google Chrome. Chrome checks for an update on that page; if one is available, install it and select Relaunch. The browser must restart for the downloaded update to take effect. Check that the version shown matches the release for your platform.
On Android, open Google Play, find Chrome and tap Update if the option appears. The version number is shown under Chrome’s Settings, in About Chrome. People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should check that browser maker’s release notes and update through its own process. Microsoft had not listed an Edge fix as of November 10, so Edge users should watch for a vendor update.
Google’s stated rollout window extends over the coming days or weeks for desktop Chrome, with Android availability expected over the next few days. Further release notes may clarify availability on other platforms and add technical details. Until then, the known status is limited to Google’s exploitation notice and the fixes listed for the released Chrome versions.
Key Questions
Which Chrome versions include the fix?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How do I update Chrome on a computer?
Open the three-dot menu, select Help, then About Google Chrome. Install any offered update and click Relaunch so the updated browser starts.
What does Google mean by an exploit in the wild?
Google says an exploit for the flaw exists in real-world use. The company has not disclosed who is using it, who is being targeted or how the attacks work.
Are other Chromium-based browsers fixed?
Availability depends on each browser maker. Vivaldi said its cited desktop update includes a fix; Brave listed a release based on the fixed Chromium version but did not name the CVE in its release text. Microsoft was working on an Edge fix, and the source found no Opera desktop post about the flaw as of November 10.
Source: Thorsten Meyer AI
