🔍 Read the full analysis: Chrome’s Eighth Zero-Day Of 2026: A Guide To The XML Vulnerability on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9 for CVE-2026-125350, a high-severity XML use-after-free flaw that it says is being exploited in the wild. The fix is the eighth Chrome vulnerability Google has flagged as exploited this year, based on its 2026 release notes. Google has not disclosed who is behind the attacks, who was targeted or how the exploit works.
Google released Chrome security updates on November 9 for a high-severity XML memory flaw, CVE-2026-125350, and said an exploit for it exists in the wild. The vulnerability is the eighth Chrome flaw Google has flagged as exploited in 2026, according to a count of the company’s release notes; Google has not said who is using it or who may have been targeted.
Google describes CVE-2026-125350 as a “use after free in XML” and rates it high severity. The bug was reported by an anonymous researcher on November 6, according to Google’s Stable Channel Update for Desktop. Google published the fix three days later. The company’s statement that an exploit exists in the wild confirms active exploitation, but it does not provide technical details about the attack or its effects.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. For Windows and Mac users on the Extended Stable channel, the listed fixed version is 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks; the Android version is expected on Google Play over the next few days.
The same release fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second bug is being exploited. The release includes nine security fixes overall, according to the source material.
Chrome’s XML vulnerability and the urgent update
Google says CVE-2026-125350 is being exploited in the wild. Install the fix for your browser and relaunch it.
What Google confirmed
The flaw is high severity; key details remain undisclosed.
Use after free in XML
Chrome may use memory after it has been released. Google has not identified the affected code path.
Active exploitation confirmed
Google says an exploit exists, but has not named attackers, targets or the scale of activity.
Get the Chrome fix
Check your platform’s version, install the update and relaunch Chrome.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux and Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update each browser separately
A Chrome update does not patch other Chromium-based browsers.
On desktop, open Help, then About Google Chrome. Android users can check Google Play.
Apply the update when available and relaunch Chrome to use the fix.
Consult Edge, Brave, Vivaldi, Opera or your browser vendor for its own update.
Why the Chrome Fix Needs Prompt Attention
When a browser maker says a vulnerability is being exploited before all users have received a fix, users face a period in which attackers may have a working route to target vulnerable installations. Google has not described the attacks, so the available information does not establish how broadly they are being used or what an attacker could accomplish through this particular flaw.
Updating Chrome and relaunching it applies the browser fix once it has been installed. On desktop, users can open the three-dot menu, select Help, then About Google Chrome, and relaunch when prompted. Android users can check Google Play for an update. People using other Chromium-based browsers should check their own vendor’s release notes: a Chrome update does not itself update those browsers.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
As an affiliate, we earn on qualifying purchases.
How the XML Flaw Was Reported
Google’s short description identifies the issue as a use-after-free memory error. In general, this class of bug occurs when software continues to use memory after it has been released. XML is a structured-data format that browsers handle in areas including XML documents and SVG graphics. Google has not specified which part of Chrome’s XML processing is affected, and this general explanation does not establish the precise mechanics or impact of CVE-2026-125350.
The eighth-zero-day count comes from the source author’s review of Google’s 2026 Chrome release notes. The seven earlier vulnerabilities listed there are CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; and CVE-2026-85046 and CVE-2026-87491 in September. SecurityWeek, The Hacker News and BleepingComputer were also reported to have the same count. This is a count of bugs Google identified as exploited in the wild, not a measure of the number of attacks or affected users.
Browser vendors may incorporate Chromium fixes on different schedules. The source material says Microsoft reported on November 9 that it was working on a fix for Edge, without listing a fixed version at that time. It reports that Vivaldi’s desktop update included the fix and that Brave listed a release built on Chromium 157.0.8103.50. It found no Opera desktop update mentioning the flaw as of November 10. These are time-specific vendor-status reports, not confirmation of the current status of every browser release.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
What Google Has Not Disclosed
Google has not identified the attackers, targets, scale or motive of the exploitation. It has also kept technical details restricted, including which part of XML handling is affected and how an exploit might work. The company’s warning confirms exploitation, but does not establish that every Chrome user was exposed to an attack or that a particular outcome occurred.
The source material also found no Chrome for iOS or ChromeOS release note mentioning this flaw as of November 10. That does not establish whether those platforms are affected or when a fix may be available. Status for other Chromium-based browsers can change as vendors publish updates; the available reports provide a snapshot, not a current inventory beyond that date.
Check Updates Across Your Browsers
Chrome users should check that their installation has reached the fixed version for their platform and relaunch the browser after installing the update. Android users can check Google Play. Users on Extended Stable should verify that they have version 156.0.8078.96 on Windows or Mac.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should consult that browser’s vendor for its own fixed release and installation instructions. Google’s Chrome release does not automatically patch separate browsers. Further information may emerge through Google’s release notes and vendor advisories, but no additional technical disclosure or attack details were included in the source material as of November 10.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free flaw in Chrome’s XML component, according to Google. The company has not specified the affected code path or published details on how an exploit works.
Is the vulnerability being exploited?
Yes. Google said it is aware of an exploit for CVE-2026-125350 in the wild. It has not identified the attackers or targets, or described the scope of the activity.
Which Chrome versions contain the fix?
Google lists versions 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac on Extended Stable. Users should check Chrome’s update page for their installed version.
Does updating Chrome fix other Chromium-based browsers?
No. Browsers such as Edge, Brave, Vivaldi and Opera depend on their vendors to ship their own releases. Check the browser maker’s security notes and install its update when available.
Why is it called Chrome’s eighth zero-day of 2026?
The count is based on eight vulnerabilities Google flagged as exploited in the wild in its 2026 Chrome release notes, including CVE-2026-125350. It counts reported vulnerabilities, not attacks, victims or affected devices.
Source: ThorstenMeyerAI.com
