Chrome zero-day CVE-2026-125350 is being exploited – update to Chrome 157 now

What happened

On 9 November 2026 Google promoted Chrome 157 to the Stable channel: version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. The release fixes nine security flaws. Google's bulletin singles out one of them: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."

That makes CVE-2026-125350 a zero-day – a flaw attackers had a working exploit for before most users had the fix. The same day Google shipped it in the Extended Stable channel (156.0.8078.96 for Windows and Mac) and in Chrome 157.0.8103.50 for Android. Google says the update will roll out "over the coming days/weeks", so some computers won't have it yet.

Technical details

Google describes the flaw in four words: use after free in XML. A use-after-free happens when a program frees a block of memory but keeps using a pointer to it. If an attacker manages to put their own data in that freed memory, the program then works with data the attacker controls. In browsers this class of bug is a common route to running code inside the renderer process, the sandboxed part of Chrome that processes web pages.

The XML component handles parsing of XML documents that a page loads or builds. In a typical browser attack, the victim only has to open a malicious page or a legitimate site that has been compromised; no download or click on a file is needed. Real-world attack chains often combine a renderer bug like this one with a second flaw to escape the sandbox. Google hasn't said whether that's the case here.

Google keeps bug reports restricted "until a majority of users are updated with a fix", so it hasn't published the exact affected code, the conditions for exploitation or how the attacks work. We don't publish exploitation details either.

The other fixes in Chrome 157 include high-severity flaws in WebGL, FileSystem, Compositing, GPU and V8 and a second use-after-free in XML (CVE-2026-125346). Google doesn't report any of them as exploited.

Who is affected

• Google Chrome on Windows and Mac older than 157.0.8103.50/.51, and on Linux older than 157.0.8103.50.
• Extended Stable (used by organisations that update every eight weeks) older than 156.0.8078.96.
• Chrome for Android older than 157.0.8103.50. Google says Android releases contain the same security fixes as the matching desktop release unless noted otherwise.
• Other Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi and others) may share the vulnerable code. Each vendor ships the fix in its own update.
• Microsoft Edge: in its Edge security release notes on 9 November, Microsoft wrote that it is aware of recent exploits in the wild and is actively working on a fix. The entry doesn't name a CVE. The latest Stable Edge, 157.0.4341.42, shipped on 5 November, before the Chromium fix. According to Microsoft, Edge for Android 157.0.4341.53 (11 November) fixes the bug; desktop Edge had no fix as of the morning of 12 November; as of 14 November Microsoft lists the fix in version 157.0.4341.46 (see Updates).

How to tell if you were compromised

Google hasn't published any indicators of compromise – no domains, IP addresses or file hashes – and hasn't said who was targeted. With browser zero-days, attacks are often aimed at a small group of people, so most users won't notice anything.

What admins can do:

• Find outdated browsers. Use your endpoint management or software inventory to list devices running Chrome older than the versions above.
• Check for unexpected child processes of Chrome in your EDR, such as command shells, PowerShell or script interpreters started by a browser process.
• Watch for new indicators. If Google, another vendor or CERT publishes indicators later, you can pull them out of their report in our IOC extractor, which runs only in your browser.

What to do

1. Update Chrome and restart it. Go to Menu → Help → About Google Chrome. The update finishes only after a relaunch – a browser with dozens of open tabs that hasn't been closed for weeks is still vulnerable.
2. On Android, update Chrome from Google Play.
3. Admins: push version 157.0.8103.50 (or 156.0.8078.96 on Extended Stable), or better the newer 157.0.8103.78 with further fixes, and enforce a relaunch through policy. Don't wait for the gradual rollout.
4. Edge and other Chromium browsers: update desktop Edge to 157.0.4341.46 or later (currently 157.0.4341.57) and Edge for Android from Google Play to 157.0.4341.53 or later. For other Chromium-based browsers, install the vendor's next security update and check its release notes for CVE-2026-125350.
5. Check again in a few days. We'll add technical details to this article once they're published.

Timeline

Updates

• 14 November 2026 – Desktop Edge is patched. Microsoft has replaced the text of its 9 November Edge security release notes entry (previously "aware of exploits, working on a fix"): it now says Edge Stable 157.0.4341.46 contains the fix for CVE-2026-125350. The entry doesn't say exactly when that build shipped – it wasn't listed on the morning of 12 November. On 13 November Microsoft followed with Edge 157.0.4341.57, which picks up further Chromium security fixes (CVEs to be added). Google has meanwhile released Chrome 157.0.8103.78: since 11 November the NVD has dozens of new records fixed in that version, at least three rated Critical by Chromium (including use-after-free bugs in ServiceWorker and Layout). None of them is marked as exploited. We recommend updating straight to that version.
• 12 November 2026 – Microsoft added an 11 November entry to its Edge security release notes: Edge for Android 157.0.4341.53 contains the fix for CVE-2026-125350, which the Chromium team reports as exploited in the wild. No patched Stable build for desktop Edge (Windows, Mac, Linux) had shipped by the morning of 12 November – the latest is still 157.0.4341.42 from 5 November. There is still no technical write-up or indicators of compromise.
• 11 November 2026 – Since the evening of 10 November, NVD has a record for CVE-2026-125350 (status "Analyzed"): weakness CWE-416 (use after free), affecting Chrome before 157.0.8103.50. CISA scored it 8.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) – exploitable over the network with no login, as long as the victim opens a crafted page – and lists exploitation as active. As of the evening of 11 November, Microsoft still hadn't shipped the Edge fix for desktop (its latest entry, from 9 November, says it is working on one). No technical write-up or indicators of compromise have been published.
• 10 November 2026, evening – CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities (KEV) catalogue; US federal agencies must patch by 24 November 2026. There is still no CVSS score and no technical write-up. For Edge on desktop, Microsoft still says it is working on a fix.
• 10 November 2026, morning – Microsoft said on 9 November that it is aware of in-the-wild exploits and is preparing an Edge fix; none had shipped by the morning of 10 November. Still no NVD record or CISA KEV listing (KEV 2026.11.09). Google hasn't posted anything new on Chrome since 9 November.
• 10 November 2026 – first version of the article.