Google has fixed a Chrome zero-day that attackers were already using. The flaw is tracked as CVE-2026-125350, and it allows a remote attacker to run malicious code in the browser. The same patch also reaches enterprise users through the Extended Stable channel.
Google Chrome Stable update closes exploited XML flaw
Google’s Stable channel update moves Chrome to version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The rollout will reach users over the coming days and weeks, and Google’s Chrome Security team keeps bug details locked until most users have the fix.
CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component. Google says it is aware that an exploit for this flaw exists in the wild. An anonymous researcher reported it on November 6, 2026, three days before the patch shipped, and Google has not said who is using the exploit or how many people were targeted.
How the Chrome zero-day works
A use-after-free flaw appears when a program keeps using memory after it has been released. Attackers can sometimes use that condition to crash the browser or run their own code, often through a booby-trapped web page. Browsers read untrusted content all day, so memory bugs in components such as XML are a common target. A victim may only need to open a bad link, and attackers can send that link through phishing emails, ads, or hacked sites.
The new patch also lands in the enterprise build. The Extended Stable channel gets the same zero-day fix in version 156.0.8078.96. The release comes just days after Chrome 157 launched, and that release fixed 213 security issues, including seven rated Critical. Google also says many of its security bugs are caught by tools such as AddressSanitizer, MemorySanitizer, Control Flow Integrity and libFuzzer before they reach the stable channel.
Other Chrome flaws in the same update
The release carries nine security fixes in total, and seven of them are rated High. Google’s list includes an uninitialized resource in WebGL, incorrect authorization in FileSystem, a buffer overflow in Compositing, an out-of-bounds write in GPU, and type confusion in V8.
A second use-after-free in XML, CVE-2026-125346, came from Arni Hardarson of Neonix Security. Two Medium flaws were also fixed, CVE-2026-125349 and CVE-2026-125342, and both are uninitialized resource bugs in the GPU. Vo Duc Thang reported the second one, and Google’s own team found most of the rest.
| CVE ID | Component | Flaw Type | Report Date |
|---|---|---|---|
| CVE-2026-125350 | XML | Use after free (exploited in the wild) | 2026-11-06 |
| CVE-2026-125346 | XML | Use after free | 2026-10-12 |
| CVE-2026-125344 | V8 | Type confusion | 2026-10-02 |
| CVE-2026-125348 | GPU | Out-of-bounds write | 2026-09-18 |
| CVE-2026-125347 | FileSystem | Incorrect authorization | 2026-09-15 |
| CVE-2026-125343 | Compositing | Buffer overflow | 2026-09-15 |
| CVE-2026-125345 | WebGL | Uninitialized resource | 2026-08-21 |
| CVE-2026-125342 | GPU | Uninitialized resource | 2026-09-26 |
| CVE-2026-125349 | GPU | Uninitialized resource | 2026-07-20 |
Update timing and browser guidance
Chrome downloads updates in the background, but the fix only works after a restart. Users can open the menu, choose Help, then About Google Chrome, and select Relaunch when it appears. Linux users should update through their package manager. People who use Chromium-based browsers should watch for vendor patches, because they often share the same engine code.
Licensed under CC BY-ND 4.0 International