Chrome 157.0.8103.50 Fixes CVE-2026-125350, an XML Use-After-Free Google Says Is Exploited. It Is the Eighth This Year. Relaunch the Browser, and Check Edge, Brave and Other Chromium Browsers
Open Chrome, go to the menu, then Help, then About Google Chrome, let it update and press Relaunch. Version 157.0.8103.50 (Windows and macOS also get .51) fixes CVE-2026-125350, which Google says has an exploit in the wild. The update has been out since Monday, November 9, and a browser that has been open for days has not applied it until it restarts. Chromium-based browsers such as Edge, Brave and Opera take the same fix on their own schedules, so check each one.
What has been reported
The primary source is Google's Chrome release notice of November 9, 2026. We could not read its body: the page text we retrieved carried only the date. Everything below comes from The Hacker News report of November 10, which quotes Google.
The flaw: CVE-2026-125350, described as a use-after-free in Chrome's XML component, rated High. No CVSS score is shown.
Exploitation: Google said it is "aware that an exploit for CVE-2026-125350 exists in the wild." It did not say how the flaw is being abused or who is behind the attacks.
Who found it: an anonymous researcher, credited with reporting it on November 6.
The release: nine security fixes in all. The report does not name the other eight.
The count: The Hacker News lists the year's earlier exploited Chrome zero-days as CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491, which makes this the eighth. We have not checked that list against Google's notices.
KEV: CISA had not listed CVE-2026-125350 in its Known Exploited Vulnerabilities catalog when we read the JSON on November 10.
What a use-after-free in XML means for you
A use-after-free is a memory bug: the browser uses a piece of memory after it has been released. Attackers use that to run code, usually after a victim opens a crafted web page. The sources give no detail on the chain, so we do not know whether this bug is used alone or together with a second one to escape the browser's sandbox. Do not assume either. The practical point is the same: the exploit is reported as live, and the fix is a restart away.
What to do
Update and relaunch Chrome on every machine, including ones that stay open for days. In a managed fleet, push the update and confirm the version, 157.0.8103.50 or later on Linux and 157.0.8103.50 or .51 on Windows and macOS.
Update Edge, Brave, Opera, Vivaldi and any app that embeds Chromium as each vendor ships the fix. Check each vendor's own release notes rather than assuming; we have not seen any of them confirm yet.
For high-risk users, restrict browsing to known sites until the update is confirmed.
Keep an eye on the release notice. Google often adds detail once most users have updated, and CISA may list the flaw in its catalog, which would set a federal deadline.
What is not known
How the flaw is being exploited, against whom, and by which group. Whether it is chained with another bug. What the other eight fixes are. Which other Chromium browsers are fixed. We add no indicators to our feed: none are published.
How we know, and how we checked
We read The Hacker News report and the CISA KEV JSON. We could not read the body of Google's release notice, so the version numbers and the quoted exploitation sentence are as The Hacker News reports them. We searched our corpus: our last post on this topic covered the fifth exploited Chrome zero-day in June, so the eight-in-a-year count is new to us and is The Hacker News's, not ours. We did not test the flaw or run any edge check, since this is a browser bug.
Sources
The Hacker News, "Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026," November 10, 2026. BleepingComputer, "Google patches eighth Chrome zero-day exploited in attacks this year," November 10, 2026. Google Chrome Releases blog, November 9, 2026 (body not readable by us). CISA Known Exploited Vulnerabilities catalog, read November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments