Google ships emergency Chrome patch for actively exploited zero-day

On Nov. 9, Google shipped emergency Chrome security updates for Windows, Mac, and Linux through the Stable channel to address an actively exploited zero-day. The flaw, tracked as CVE-2026-125350, is a high-severity use-after-free memory handling bug in Chrome’s XML component. Google said attackers are actively exploiting the CVE-2026-125350 zero-day in the wild, though the company declined to identify the attackers, targets, delivery method, or exploit capabilities.

For Windows and Mac, the patched desktop builds are 157.0.8103.50/.51; Linux users need 157.0.8103.50. Google put out the Android build, Chrome 157.0.8103.50, on Nov. 9.

Google got the vulnerability report from an unnamed third party on Nov. 6 and shipped the fix on Nov. 9, three days later. Chrome usually pushes updates only after a browser restart, so most Stable channel users who leave it open may fall behind.

The company has fixed eight actively exploited Chrome zero-days so far in 2026. Google fixed seven other actively exploited zero-days in 2026: CVE-2026-2441 in mid-February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April, CVE-2026-11645 in June, and CVE-2026-87491 and CVE-2026-85046 in September. In 2025, Google fixed eight more exploited zero-days, many reported by its Threat Analysis Group.

Previous exploited Chrome zero-days in 2026 touched CSSFontFeatureValuesMap, Skia 2D graphics, Dawn WebGPU, and the V8 JavaScript engine. HKCERT rates CVE-2026-125350 as Extremely High and warns of denial of service, security restriction bypass, and possible remote code execution.

Because Chrome’s XML parser processes data and deletes an object from memory without clearing the pointer, attackers can manipulate freed memory to run malicious code. Softonic says the flaw can crash devices, corrupt data, or let attackers run code on malicious sites.

Google said the patch could take days or weeks to reach every Chrome user. At reporting time, CISA had not added CVE-2026-125350 to the Known Exploited Vulnerabilities catalog. Until most users install the update, Google limits access to bug details and may keep restrictions in place if an unfixed third-party library contains the flaw.

Users of Microsoft Edge, Brave, Opera, or Vivaldi should watch for matching Chromium updates. Google says Android releases get the same security fixes as matching desktop builds unless Google notes an exception, and the Android release notes mention only stability and performance improvements.

Chrome 157 includes nine security fixes, rated seven High and two Medium. Other fixes cover CVE-2026-125346, another use-after-free in XML; CVE-2026-125344, type confusion in V8; CVE-2026-125348, an out-of-bounds write in the GPU component; and CVE-2026-125343, a buffer overflow in Compositing.

Chrome 157 was announced by Google on Nov. 3 in US time and moved to the Stable channel for Windows, Mac, and Linux. Chrome 157 came to Android and iPhone or iPad on Nov. 3, followed by another Android build on Nov. 5.

Chrome 158 started reaching some Windows users on Nov. 4 as an early Stable release. Google also moved Chrome Extended Stable to version 156 on Nov. 3 with 55 security fixes for organizations on the slower channel. On Sept. 8, 2026, Chrome switched to a two-week release schedule from four weeks, beginning with Chrome 153.

Google’s Chrome Releases post on 213 security fixes in Chrome 157 did not describe any as exploited before the fix. “The Chrome team is delighted to announce the promotion of Chrome 157 to the stable channel for Windows, Mac and Linux.” When BleepingComputer checked on Nov. 10, 2026, it found the Chrome security update available immediately.

To update manually, desktop users can open About Google Chrome in Settings or Help, then click Relaunch when prompted to update manually. Android users should check Settings, then About Chrome; build 157.0.8103.50 or later contains the fix, and updates arrive via the Play Store under Manage apps & device.

Google Play stages the patch, so some handsets remain on the vulnerable build for days; a manual check closes the gap fastest. Users should also confirm their phone carries the November 2026 Android security patch. A separate exploit reported the prior week showed older Chrome builds on unpatched Snapdragon phones could let attackers steal logins.

If About Google Chrome shows no Relaunch button, Chrome is already up to date; a restart brings back normal tabs but not Incognito windows. The emergency patch is live now for Windows, Mac, and Linux Stable builds.