Google has released an emergency Chrome update for a security flaw that attackers are already using. The bug, CVE-2026-125350, sits in the part of the browser that handles XML, and the fix only protects you once Chrome has downloaded the new version and restarted.
The patched release, Chrome 157.0.8103.50, went out on November 9, just three days after an anonymous researcher reported the flaw. In its release notes, Google rates the bug High and says it is aware that an exploit for it "exists in the wild."
The timing stings a little. Chrome 157 only reached the stable channel on November 3 with 213 security fixes. This follow-up carries just nine, and one of them is the reason it cannot wait.
Which Chrome version fixes the exploited CVE-2026-125350 flaw
On Windows and Mac, the fixed build is 157.0.8103.50 or 157.0.8103.51. Linux gets 157.0.8103.50. Google says the update "will roll out over the coming days/weeks," so a browser left to its own devices may not pick it up straight away.
Chrome for Android moved to the same 157.0.8103.50 build, which reaches Google Play "over the next few days" and carries the same security fixes as the desktop release. Businesses that keep Chrome on the slower Extended Stable channel get the fix in version 156.0.8078.96 for Windows and Mac.
The other eight fixes are not trivial either. Six more are rated High, including a second XML use-after-free bug (CVE-2026-125346), a type confusion flaw in the V8 JavaScript engine and an out-of-bounds write in the GPU code. Two GPU bugs are rated Medium. Only CVE-2026-125350 is flagged as exploited.
What CISA says the Chrome XML flaw lets attackers do
Google has not said who is using the flaw, against whom, or how widely. It keeps bug details restricted "until a majority of users are updated with a fix," a caution that appears on its security releases as a matter of routine.
The US Cybersecurity and Infrastructure Security Agency filled in some of the picture on November 10, when it added the bug to its Known Exploited Vulnerabilities catalog. A "specially crafted webpage" could let a remote attacker "execute arbitrary code inside the sandbox," according to CISA. In plain terms, opening a booby-trapped page could be enough to run an attacker's code, though only inside the walled-off space Chrome uses for web content.
The listing gives US federal civilian agencies until November 24 to patch. That deadline binds only those agencies, but the catalog is a useful signal for everyone else, as it was when CISA flagged actively attacked Windows, SharePoint, VMware and macOS flaws in August.
Microsoft Edge, Brave and Opera need their own Chromium update
The flaw lives in Chromium, the open-source code behind several popular browsers. CISA names Google Chrome, Microsoft Edge and Opera among the browsers that could be affected, adding that the list is "not limited to" them. Each of those browsers ships the fix on its own schedule, so updating Chrome does nothing for Edge on the same PC.
Microsoft had not shipped its fix as of November 10. Its Edge security release notes carry a November 9 entry in which Microsoft acknowledges the exploits and says it is "actively working on releasing a security fix" for Edge. The newest Edge Stable build listed there, 157.0.4341.42, came out on November 5, before Google's patch.
Brave moved faster. Its release 1.99.56, dated November 10, upgrades the browser to Chromium 157.0.8103.50. Opera, which added a Paste Protect defence against clipboard hijacking earlier this year, is named in CISA's entry as well, so its users should look for an update built on the patched Chromium code.
How to update Chrome now and make sure the fix is active
Chrome normally updates itself in the background, but the new version applies only after a restart. To force it, open the three-dot menu, choose Help, then About Google Chrome, and select Relaunch, as Google's help page describes. If there is no Relaunch button, you are already on the latest version. Your open tabs and windows come back after the restart, though Incognito windows do not.
Check that the version number reads 157.0.8103.50 or higher. On Android, open Chrome's page in the Play Store and tap Update if it appears. In Edge, visit the About Microsoft Edge page in Settings over the coming days and install the fix as soon as Microsoft releases it.
Chrome 158 is scheduled to reach the stable channel on November 17, but there is no reason to wait for it. The patch for a bug that attackers are already using is available now, and it takes one relaunch to apply.
Discussion (0)
Be the first to comment.