Google Patches Eighth Actively Exploited Chrome Zero-Day of 2026 — Update Now

admin · November 10, 2026 · 7 min read

Google Chrome browser shield on a laptop screen with a security update warning, illustrating the emergency patch for CVE-2026-125350

Google has released an emergency security update for its Chrome browser to fix a high-severity vulnerability that attackers are already exploiting in the wild, the company confirmed on Monday, November 9. The flaw, tracked as CVE-2026-125350, is the eighth Chrome zero-day Google has patched this year — and users should install the update now rather than wait for it to arrive automatically.

The update, Chrome 157 for desktop, fixes nine security vulnerabilities in total. But one of them stands apart: Google said it is “aware that an exploit for CVE-2026-125350 exists in the wild,” meaning attackers were using the bug against real targets before a fix was available.

What the vulnerability is

CVE-2026-125350 is a use-after-free flaw in Chrome’s XML component, Google said in its November 9 advisory. Use-after-free bugs occur when a program deletes an object from a computer’s memory but fails to clear the pointer that still references it. An attacker who can trigger that mistake can corrupt the browser’s memory — and, in the worst case, run malicious code on the victim’s machine.

The flaw was reported to Google on November 6 by a security researcher who chose to remain anonymous. Google has not assigned the vulnerability a public CVSS severity score, and it has not shared any details about how the attacks work, who is behind them, or who may have been targeted.

That silence is deliberate. Google said access to bug details and links “may be kept restricted until a majority of users are updated with a fix,” a standard practice meant to avoid handing attackers a ready-made recipe while millions of browsers are still unpatched.

Which versions are fixed

The patched builds are rolling out now in Chrome’s Stable Desktop channel:

Windows and macOS: Chrome 157.0.8103.50 or 157.0.8103.51
Linux: Chrome 157.0.8103.50
Extended Stable (Windows and macOS): Chrome 156.0.8078.96, which includes 11 security fixes

Google said the update will roll out gradually over the coming days and weeks. But when BleepingComputer checked for the update manually on Tuesday, November 10, it was available immediately — a reminder that users do not have to wait for Chrome to fetch it on its own.

The release also fixes eight other security bugs, including a second high-severity use-after-free flaw in the same XML component, tracked as CVE-2026-125346, along with issues affecting WebGL, the FileSystem API and Chrome’s V8 JavaScript engine.

How to check and update Chrome

Updating takes less than a minute, but the browser must restart to apply the fix. Here is how to do it on a desktop computer:

Open Chrome and click the three-dot menu in the top-right corner.
Go to Help, then About Google Chrome.
Chrome will check for updates automatically and download the new version.
Click Relaunch to restart the browser and finish installing the update.

After relaunching, return to the About page and confirm the version number. If it starts with 157.0.8103.50 or higher on Windows, macOS or Linux, the patch is installed. Users on the Extended Stable channel should see 156.0.8078.96 or higher.

Chrome normally updates itself in the background, but the staged rollout means some users could wait days or weeks before the new version arrives on its own. Checking manually closes that window.

Eight zero-days in ten months

The new flaw continues a steady drumbeat of browser attacks in 2026. With CVE-2026-125350, Google has now patched eight actively exploited Chrome zero-days since the start of the year:

CVE-2026-2441
CVE-2026-3909
CVE-2026-3910
CVE-2026-5281
CVE-2026-11645
CVE-2026-85046
CVE-2026-87491
CVE-2026-125350

Google patched eight more exploited Chrome zero-days in 2025, many of them reported by the company’s Threat Analysis Group, which tracks zero-day exploits used in spyware attacks. The pace has not slowed: roughly one actively exploited Chrome flaw has surfaced every five to six weeks this year.

That pattern matters because Chrome is the world’s most widely used browser, running on billions of devices. A single exploited flaw in Chrome is not a niche problem — it is a potential entry point into homes, offices and government systems everywhere.

What is still unknown

Several important questions remain unanswered. Google has not said when the exploitation began, how victims were reached, or whether the attacks were targeted or widespread. The U.S. Cybersecurity and Infrastructure Security Agency, known as CISA, had not yet added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog as of Tuesday morning, though that listing typically follows Google’s disclosure.

Security researchers expect more details to emerge once most users have updated, when Google traditionally lifts its restrictions on the bug report. Until then, the practical advice is simple and does not depend on the missing details: install the update.

Why this matters

Browser zero-days are among the most valuable flaws in cybersecurity because they can turn an ordinary visit to a website into a compromise. A use-after-free bug in a component as common as XML parsing is especially concerning, since XML is used across countless web pages and services.

The broader picture is also worth noting. The technology industry has spent much of the past week dealing with security fallout on several fronts. France blamed Iran’s Revolutionary Guards for a cyberattack that set supermarket refrigerators on fire at nearly 700 food distribution sites in October, and Nvidia said its board had opened an independent investigation into reports that its chief executive had been targeted by a foreign intelligence operation. The Chrome flaw is a different kind of threat — a software bug rather than a state-backed campaign — but it lands in the same unsettled environment, and it affects far more people directly.

For most users, the risk is manageable. Chrome’s sandbox and automatic updates limit the damage, and this patch closes the hole. The danger is in delay: every day an unpatched browser stays in use is another day the exploit remains viable.

Latest developments

Google released the Chrome 157 security update on Monday, November 9, 2026.
The update patches nine vulnerabilities, including the actively exploited CVE-2026-125350.
Fixed versions are 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux; Extended Stable users should install 156.0.8078.96.
BleepingComputer confirmed the update was available immediately when checked manually on November 10, even though Google’s staged rollout could take days or weeks to reach all users automatically.
CISA had not yet added the flaw to its Known Exploited Vulnerabilities catalog as of Tuesday morning.
Google has not disclosed attack details, victim information or attribution, and says technical details will remain restricted until a majority of users are updated.

Frequently asked questions

What is a zero-day vulnerability?

A zero-day is a security flaw that attackers are already exploiting before the software maker has released a fix — in other words, the vendor has had “zero days” to respond. They are considered especially dangerous because there is no patch available during the window between discovery and the fix.

Am I affected by CVE-2026-125350?

If you use Google Chrome on Windows, macOS or Linux, you should assume you are affected until you confirm your version. Any Chrome build below 157.0.8103.50 does not contain the fix. Check your version at Help > About Google Chrome and update if needed.

How do I update Chrome?

Open the three-dot menu, go to Help, then About Google Chrome. Chrome will check for updates and download the new version automatically. Click Relaunch to restart the browser and apply the patch. The update is free and takes less than a minute.

What is a use-after-free flaw?

Use-after-free is a type of memory bug. It happens when a program deletes an object from memory but keeps a pointer to where that object used to be. If an attacker can control what gets written into that freed memory, they can corrupt the program’s behavior — and potentially execute their own code.

The fix is out, it is free, and it takes less than a minute to install. For a flaw that attackers are already using, that is the easiest security decision a Chrome user will make all week.