🔍 Read the full analysis: Is Your Chrome Version Safe From The XML Bug? Here’s What To Update on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome updates on Nov. 9, 2026, fixing CVE-2026-125350, a high-severity XML use-after-free flaw the company says is being exploited. Update to the listed fixed version for your platform and relaunch Chrome; Google says the rollout will take days or weeks. Attackers, targets and technical details remain undisclosed.
Google released Chrome security updates on Monday, Nov. 9, fixing nine security issues, including CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit for the bug exists in the wild, meaning attacks are already using it; users should check for the fixed version for their platform and restart the browser after installing it.
Google’s release notes describe CVE-2026-125350 as a “Use after free in XML” issue and rate it high severity. The company says it is aware of exploitation but has not published details about how the attack works. The flaw was reported by an anonymous researcher on Friday, Nov. 6, and the fix was released three days later.
Google lists these fixed versions: 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Organizations using Extended Stable on Windows and Mac should update to 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected to become available through Google Play over the next few days.
The same release also fixes CVE-2026-125346, another XML use-after-free issue, reported by Arni Hardarson of Neonix Security on Oct. 12. Google’s notes do not say that this second flaw is being exploited. On a computer, users can open Chrome’s three-dot menu, select Help and then About Google Chrome, and install any offered update. They must click Relaunch for the new version to take effect. Android users can check Google Play for an update.
Is Your Chrome Version Safe From The XML Bug? Here’s What To Update
Google says a high-severity Chrome XML flaw is being exploited. Install the fixed version for your platform and relaunch Chrome.
Get the platform-specific patch
Check for your listed version, install the update, then relaunch Chrome.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update and relaunch
The rollout is gradual, so the patch may not be available to every installation yet.
Open the three-dot menu, choose Help, then About Google Chrome.
Install the offered update and click Relaunch for it to take effect.
Look for a Chrome update in Google Play.
What is known—and still unclear
- Google rates the XML use-after-free flaw high severity.
- Google says an exploit exists in the wild.
- The same release fixes another XML use-after-free issue.
- Who is behind the exploitation or who was targeted.
- How the exploit works or what attackers can do through this flaw.
- The scale of attacks.
Other Chromium browsers need their own updates
Chrome’s fixed version does not update separate browsers.
Fix in progress
Microsoft said it was working on a security fix; the cited notes did not list a fixed version.
Fix noted
Its desktop update based on Chromium 156.0.8078.99 includes a fix for the flaw.
Version listed
Version 1.99.56 is based on Chromium 157.0.8103.50; its release text did not mention the CVE.
No mention yet
The cited desktop updates did not yet mention the flaw.
Why the XML Bug Needs Prompt Attention
The immediate concern is Google’s statement that the flaw is already being exploited, not a public account of the attack’s mechanics. A use-after-free bug occurs when software reuses memory after it has been released. Depending on how an attacker can trigger and control the error, such flaws can cause crashes or potentially allow more serious activity; the available information does not establish what attackers can do through this specific bug.
Google says the patch is rolling out gradually, so not every installation will receive it at once. Checking manually can show whether the update is available, but protection requires restarting Chrome after the update is installed. People using other Chromium-based browsers should also check their browser maker’s release notes: Chrome’s fixed version does not itself update those separate products.
Products Worth Considering
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
As an affiliate, we earn on qualifying purchases.
How Google and Other Browsers Responded
Google’s release notes say the vulnerability was reported on Nov. 6 and fixed on Nov. 9. The company has restricted technical details while the issue is being addressed. Its desktop update includes eight other security fixes, bringing the total to nine fixes in this release.
According to the source report’s review of Google’s 2026 release notes, this is the eighth Chrome flaw this year for which Google has said it is aware of exploitation in the wild. The same count was reported by SecurityWeek, The Hacker News and BleepingComputer. That count describes Google’s published notices; it does not by itself indicate how many people were attacked or the scale of any incidents.
Other browser makers publish and distribute their own Chromium-based releases. Microsoft said on Nov. 9 that it was aware of recent exploits and was working on a security fix for Edge, but had not listed a fixed version in the cited notes. Vivaldi said its desktop update based on Chromium 156.0.8078.99 includes a fix for CVE-2026-125350. Brave’s listed version 1.99.56 is based on Chromium 157.0.8103.50, though its release text did not mention the CVE. The cited Opera desktop updates did not yet mention the flaw.
““Google is aware that an exploit for CVE-2026-125350 exists in the wild.””
— Google, in its Chrome security release notes
What Google Has Not Disclosed
Google has not said who is behind the exploitation, which users or organizations were targeted, how many attacks occurred, or how the exploit works. It has also not described the vulnerability’s precise location within Chrome’s XML handling. The high-severity rating and in-the-wild warning establish the need for a patch, but do not answer those questions.
The rollout is still in progress, and availability can vary by platform and installation. The source report found no Chrome for iOS or ChromeOS release note mentioning this flaw as of Nov. 10; that does not confirm whether or when a fix for those products will arrive. The cited information also does not establish fixed versions for every Chromium-based browser.
Check for Platform-Specific Patches
Chrome users should check About Google Chrome on desktop and Google Play on Android, install the update when available, and relaunch the browser. If Chrome reports that it is up to date but shows a version earlier than the listed fix, users may need to check again as Google’s rollout continues.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should follow that vendor’s security announcements and install its own patched release. Google’s Chrome version numbers are not a substitute for a vendor-specific update. Further details may emerge as browser makers ship patches and Google changes the restrictions on vulnerability information; no timeline for additional technical disclosures was provided in the cited material.
Key Questions
Which Chrome versions include the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, Chrome 157 (157.0.8103.50) for Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How do I install the Chrome update?
On desktop, open Chrome’s three-dot menu, choose Help, then About Google Chrome. Install the update and click Relaunch. On Android, look for Chrome in Google Play and tap Update if it is available.
Does Google say attackers are using this flaw?
Yes. Google says it is aware of an exploit for CVE-2026-125350 in the wild. The company has not disclosed who is using it, who was targeted or how the exploit works.
Are Edge and other Chromium browsers covered by Chrome’s update?
No. Chromium-based browsers depend on updates from their own vendors. Check the relevant browser’s release notes and install its fixed version when available; the source report said Microsoft was still working on an Edge fix as of Nov. 9.
Source: ThorstenMeyerAI.com
