🔍 Read the full analysis: Chrome’s Eighth 2026 Zero-Day Targets XML: Check Your Browser Version on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on Nov. 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component that the company says is being exploited in the wild. Google’s 2026 release notes identify this as the eighth Chrome flaw this year for which it has reported in-the-wild exploitation. The attacker, targets and exploit method have not been disclosed.
Google released Chrome security updates on Nov. 9 to fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit for the bug exists in the wild, making this the eighth Chrome vulnerability in 2026 for which its release notes have flagged active exploitation; users should check that their browser is updated and restarted.
Google’s release notes describe CVE-2026-125350 as a “use after free in XML” and rate it high severity. A use-after-free occurs when software continues to use a memory location after it has been released. Depending on how a flaw is triggered and exploited, memory-safety bugs can cause crashes or potentially allow other harmful outcomes; Google has not disclosed the specific consequences of this vulnerability or how the reported exploit works.
Google lists fixed desktop versions as 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. Organizations using the Extended Stable channel should check for 156.0.8078.96 on Windows and Mac. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days.
The same update addresses another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on Oct. 12. Google’s notes do not say that this second flaw is being exploited. The Chrome 157 desktop bug was reported by an anonymous researcher on Nov. 6, three days before Google published the fix.
To check on a computer, open Chrome’s three-dot menu, select Help, then About Google Chrome, and install any available update. Restart Chrome to apply it. On Android, check the Chrome listing in Google Play for an update; the version number is also shown under Settings and About Chrome.
Chrome’s XML zero-day Check and restart your browser
Google says CVE-2026-125350 is being exploited in the wild. Install the update when it becomes available, then restart Chrome.
What Google confirmed
The flaw is a use-after-free in Chrome’s XML component. Google has not described how the exploit works or who it targets.
- An exploit exists in the wild.
- The flaw affects Chrome’s XML component.
- Attackers and targets
- Exploit method and consequences
Check your version
Updates are rolling out; desktop distribution may take days or weeks.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux and Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update and restart
On desktop, check Chrome’s About page. Android users can check Google Play.
Open the three-dot menu, then Help and About Google Chrome.
Apply the available update, or check Google Play on Android.
Relaunch the browser to apply the update.
Other Chromium browsers
Each vendor distributes its own fixes, so Chrome’s patched version does not confirm protection elsewhere.
- Check current notices from Edge, Brave, Vivaldi, Opera, and your browser’s vendor.
- Google has not said how many attacks occurred or how many people were affected.
Why the XML Flaw Needs Attention
The immediate concern is that Google has acknowledged in-the-wild exploitation while withholding technical details. That does not establish who is carrying out attacks, which users are at risk or what attackers can achieve. It does mean the issue is not merely a theoretical weakness, and applying the vendor’s fix is the practical step available to users.
Chrome does not necessarily install an update everywhere at once. Google says rollout can take days or weeks for desktop users, so checking manually can show whether a fix is available sooner. Even after downloading an update, users need to restart the browser for it to take effect.
The update also matters beyond Chrome because several browsers use Chromium, the open-source project behind Chrome. Those products rely on their own vendors to package and distribute fixes. Chrome’s patched version alone does not confirm that another Chromium-based browser has received the same protection.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and 12MP Center Stage Camera (2026, Silver)
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 24GB Memory, 1TB SSD, Midnight
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 2TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
Chrome’s 2026 Exploitation Record
The eighth count comes from reviewing Google’s 2026 Chrome release notes for statements that it was aware of an exploit “in the wild.” The earlier vulnerabilities named in that count are CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; and CVE-2026-85046 and CVE-2026-87491 in September. The source report says SecurityWeek, The Hacker News and BleepingComputer also reported the same total.
Four of the eight were in V8, Chrome’s JavaScript engine, according to the source’s review. The current flaw is in Chrome’s XML component, but Google has not identified the precise affected code path. The annual count describes vulnerabilities Google flagged as exploited in its own release notes; it does not by itself establish how many attacks occurred or how many people were affected.
Other browser vendors publish their own security updates. As of Nov. 10, Microsoft said it was working on an Edge fix and had not listed a fixed version in the release notes cited by the source. Vivaldi’s desktop update was reported to include a fix, while Brave’s listed release was built on Chromium 157.0.8103.50. The source found no Opera desktop update mentioning the flaw. These details can change as vendors publish new releases, so users should check their browser maker’s current notices.
““Google is aware that an exploit for CVE-2026-125350 exists in the wild.””
— Google, in its Chrome security release notes
Attackers and Targets Remain Unknown
Google has not said who is behind the exploitation, which individuals or organizations were targeted, how many attacks occurred, or how the exploit works. It has restricted technical details while the issue is being addressed. The available release notes also do not specify the exact XML feature or circumstances required to trigger the flaw.
The status for browsers other than Chrome is not uniform in the source material and may have changed since it was checked on Nov. 10. No Chrome for iOS or ChromeOS notice mentioning this vulnerability was identified in the cited release notes at that time. That absence does not establish that those products are affected or unaffected; users should watch for notices from the relevant vendor.
Check for Vendor Updates
Chrome users should check for the fixed version for their platform, install it when available and relaunch the browser. Android users can check Google Play, where Google said the release would become available over the next few days. Organizations on Extended Stable should verify that Windows and Mac devices are on version 156.0.8078.96.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should follow their own vendor’s release notes rather than assume that Chrome’s update has reached them. Google and other vendors may publish additional technical information or product-specific fixes as rollout continues; the timing and contents of any further disclosures were not specified.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit exists in the wild but has not described how it works.
Which Chrome versions fix the vulnerability?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac on the Extended Stable channel.
How can I check whether Chrome is updated?
On desktop, open the three-dot menu and go to Help, then About Google Chrome. Install an available update and relaunch Chrome. On Android, check for an update in Google Play.
Does the warning apply to every Chromium-based browser?
Chrome’s release does not confirm that other Chromium-based browsers are patched. Each vendor distributes its own updates, so check the browser maker’s security notices and version information.
What is known about the attacks?
Google confirms that an exploit exists in the wild. The company has not disclosed who is responsible, who was targeted, how many attacks occurred or how the exploit works.
Source: ThorstenMeyerAI.com
