🔍 Read the full analysis: How To Protect Chrome From The XML Bug With The Right Version on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome security updates on November 9, 2026, including a fix for CVE-2026-125350, a high-severity XML use-after-free bug it says is being exploited. Update Chrome to the fixed version for your platform and relaunch; users of other Chromium-based browsers should check their vendor’s release notes.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says it is aware of an exploit being used in the wild, making it important for users to install the fixed version and restart the browser rather than wait for an automatic update.
The fixed versions listed by Google are 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Organizations using the Extended Stable channel should install 156.0.8078.96 for Windows and Mac. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days.
On a computer, open Chrome’s three-dot menu, select Help, then About Google Chrome. The browser checks for an update there; after it downloads, click Relaunch to apply it. On Android, check Chrome’s Google Play listing for an Update button. Users can find the installed version in Chrome’s Settings under About Chrome. A downloaded update does not take effect until the browser restarts.
Google also fixed CVE-2026-125346, another XML use-after-free bug, in the same desktop update. The company’s release notes do not say that the second flaw is being exploited. Google identifies the researcher who reported CVE-2026-125350 only as anonymous and says the report came on November 6; the fix followed three days later.
Protect Chrome from the XML bug Install the fixed version
Google says CVE-2026-125350 is being exploited in the wild. Update Chrome for your platform and relaunch to apply the fix.
Update Chrome now
A downloaded update takes effect after you relaunch the browser.
On desktop, open the three-dot menu, choose Help, then About Google Chrome. On Android, check Chrome’s Google Play listing.
Confirm your version matches the release for your platform. Updates may arrive in stages.
Click Relaunch on desktop to apply the update. Check again later if it is not available yet.
What the flaw means
Google rates the XML use-after-free bug High and says an exploit exists in the wild.
- The flaw affects Chrome’s XML component.
- Google says it is aware of exploitation.
- Attackers, targets, and exploit method.
- The scale or impact of any campaign.
Check each browser separately
A Chrome update does not update other Chromium-based browsers.
| Browser or platform | Reported update status | What to do |
|---|---|---|
| Chrome | Fixed versions listed by platform | Install and relaunch |
| Edge | No fixed version listed | Watch Microsoft’s release notes |
| Vivaldi | Desktop update includes the fix | Install the vendor release |
| Brave | Version 1.99.56 uses Chromium 157.0.8103.50 | Check Brave’s release notes |
| Opera, iOS, ChromeOS | No matching update noted in the supplied material | Watch vendor updates |
Why the XML Fix Needs Prompt Attention
Google’s statement that an exploit exists in the wild means the issue is not merely a theoretical weakness: attack code is reportedly being used before all users have necessarily received the update. The company has not described the attacks or their targets, so users cannot use the available information to judge whether they are personally at risk. Installing the corrected build is the practical step available to close the known vulnerability.
A use-after-free happens when software tries to use memory after it has been released. Depending on how a flaw can be reached and exploited, this class of bug may cause a crash or allow more serious effects. The Hacker News has noted that use-after-free vulnerabilities can lead to data corruption, crashes or arbitrary code execution; that is general risk context, not confirmation of what this particular exploit does. Google rates this bug High but has not published its technical details.
The fix also matters beyond Chrome itself. Browsers such as Edge, Brave, Opera and Vivaldi use Chromium, but each vendor must issue and distribute its own browser update. Having Chrome’s fixed version installed does not update a separate browser.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Dyson Airwrap i.d. Multi-Styler for Straight and Wavy Hair
As an affiliate, we earn on qualifying purchases.
How Vendors Are Applying the Chromium Fix
Google’s release notes say the desktop update will reach users over the coming days or weeks, so availability may differ by device. The Android build is distributed through Google Play. Google says Android releases include the same security fixes as their corresponding desktop releases unless it specifies otherwise. As of November 10, the supplied source material found no Chrome release-note post for iOS or ChromeOS mentioning this flaw; users of those platforms should watch for vendor updates rather than assume they are covered.
Other Chromium browser makers had different update statuses on November 10. Microsoft said it was aware of the exploits and was working on a security fix, but had not listed a fixed Edge version. Vivaldi’s desktop update moved to Chromium 156.0.8078.99 and said it included a fix for CVE-2026-125350. Brave listed version 1.99.56, built on Chromium 157.0.8103.50, though its release text did not name the CVE. Opera’s latest stable desktop post in the source material was dated November 4 and did not mention the flaw.
The source article counted eight Chrome vulnerabilities in 2026 for which Google’s release notes said an exploit existed in the wild, including this one. That is a count of reported vulnerabilities, not a measure of how many people were attacked or how widespread any campaign was.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details and Browser Coverage
Google has not publicly explained who is behind the attacks, which users or organizations were targeted, how the exploit works, or what activity it enables. The company is restricting technical details for now. Its statement confirms awareness of exploitation, but does not establish the scale or impact of any attack campaign.
Availability also varies by browser and platform. The source material does not identify a fixed Edge version as of November 10, and it reports no Chrome release-note post for iOS or ChromeOS that mentions CVE-2026-125350. For browsers other than Chrome, users should rely on that browser’s vendor rather than infer protection from its Chromium foundation or from a Chrome update.
Check for Your Vendor’s Release
Chrome users should check About Google Chrome or Google Play, install the applicable fixed build when available, and relaunch the browser. Because Google is distributing the update in stages, users who do not yet see it can check again later. Organizations on Extended Stable should confirm they are running version 156.0.8078.96 on Windows or Mac.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should monitor their browser maker’s security notices and install that vendor’s release when it is available. Further details may emerge if Google lifts restrictions on the vulnerability information or vendors publish additional update notes. The timing and scope of any such disclosures are not stated in the source material.
Key Questions
Which Chrome version fixes CVE-2026-125350?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should use 156.0.8078.96.
How do I install the Chrome update?
On desktop, open the three-dot menu, go to Help, then About Google Chrome. Let Chrome check and download the update, then select Relaunch. On Android, check for an update on Chrome’s Google Play page.
Does Google say the XML bug is being exploited?
Yes. Google says it is aware of an exploit for CVE-2026-125350 in the wild. It has not publicly described the attackers, targets or exploit method in the supplied release information.
Does updating Chrome also fix Edge or Brave?
No. Chromium-based browsers receive updates from their own vendors. Check the relevant browser’s version and security release notes; a Chrome update does not install a fix in a separate browser.
What does “use after free” mean?
It describes software using a section of memory after it has been released. Google identifies this bug in Chrome’s XML component and rates it High, but has not published enough detail to explain the exact way the flaw can be triggered or what the reported exploit does.
Source: ThorstenMeyerAI.com
