CVE-2026-125350: Chrome's Eighth Zero-Day of 2026 Is Being Exploited. Update to 157.0.8103.50

Open Chrome's menu, go to Help, then About Google Chrome. If the number on that page is lower than 157.0.8103.50, your browser has a hole that attackers are already using, and the fix is one click away. If Chrome says an update is ready, press Relaunch. That is the whole job for most people, and it takes less than a minute.

Written November 11, 2026. Google has not yet published technical details, so some facts below may change.

The reason for the hurry: on Monday, November 9, Google shipped a Chrome update that fixes nine security bugs. One of them, CVE-2026-125350, came with the sentence Google reserves for the bad ones. "Google is aware that an exploit for CVE-2026-125350 exists in the wild," the advisory says, as quoted by BleepingComputer. A day later the US cybersecurity agency CISA added the bug to its list of vulnerabilities confirmed as exploited.

What CVE-2026-125350 actually is

The bug sits in the part of Chrome that reads XML, a text format that websites and feeds use to structure data. Every copy of the browser carries that code.

The flaw type is called a use-after-free. In plain terms, it is a memory-safety mistake: the program throws away a piece of memory, then keeps using its old note about where that memory was. BleepingComputer describes this one as the XML parser deleting an object without clearing the pointer that still refers to it. If an attacker can arrange what lands in that freed space, Chrome ends up reading attacker-chosen data as if it were its own.

The official description, quoted by The Hacker News from the CVE record, says the flaw "allowed a remote attacker to execute arbitrary code" inside the browser sandbox through a crafted HTML page. Three parts of that sentence matter:

• Remote attacker. Nobody needs to touch your computer or know your password.
• Crafted HTML page. The trigger is a web page. Visiting the wrong link, or a normal site that has been tampered with, is enough to reach the vulnerable code.
• Inside the sandbox. Chrome runs web pages in a locked-down box. Code running there can see what that tab sees, but it does not automatically control the rest of the computer.

The Hacker News reports a CVSS severity score of 8.8 out of 10, which lands in the high band. Google rates it High as well.

What attackers can do with the Chrome XML bug

Google has said almost nothing about the attacks. It has not named who is behind them, who was targeted, or how many people were hit. SecurityWeek says it found no public information about the campaign either. That silence is normal. Google's advisory notes that bug details "may be kept restricted until a majority of users are updated with a fix," so that other attackers cannot copy the technique while millions of browsers are still unpatched.

What we can say comes from the flaw type itself. Code execution inside the sandbox lets an attacker run their own instructions in the process that renders a page. In past Chrome attacks, bugs like this have been the first link in a chain, paired with a second flaw that breaks out of the sandbox and reaches the operating system. Whether a second bug was used here is not public, and this article will not guess.

We also do not know who found it in use. Google credits an anonymous researcher who reported the bug on November 6, 2026. The patch shipped three days later.

Eight exploited Chrome zero-days in 2026

This is the eighth time this year that Google has patched a Chrome bug that attackers found first. BleepingComputer, The Hacker News and SecurityWeek all list the same seven predecessors. The count matches all of 2025, when Google also fixed eight, according to BleepingComputer, and 2026 still has seven weeks left.

Most of the earlier ones were in V8, the engine that runs JavaScript, or in graphics code such as Skia and Dawn. An XML bug is the odd one out. It is a reminder that old, quiet parts of a browser get attacked too.

Which Chrome versions fix CVE-2026-125350

According to Google's release notes as reported by The Hacker News and SecurityWeek, the fixed builds are:

Anything lower is vulnerable. Qualys puts it simply: all Chrome versions before 157.0.8103.50 are affected.

Google says the rollout can take days or weeks to reach everyone automatically. BleepingComputer found the update available right away when it checked by hand, so you do not need to wait your turn.

The same release also closes eight other holes. SecurityWeek counts six rated High in WebGL, FileSystem, Compositing, GPU, V8 and XML, plus two Medium issues in the GPU component. None of those is reported as exploited, but they are eight more reasons to take the update.

The sources reviewed for this article cover the desktop release only. They do not give a fixed version for Chrome on Android or iPhone. If you use Chrome on a phone, install whatever update the Play Store or App Store offers and keep automatic updates on.

How to update Chrome and confirm the fix

The step people skip is the last one. Chrome downloads updates quietly in the background, but the old, vulnerable code keeps running until the browser restarts. If you are the sort of person who leaves 40 tabs open for three weeks, you can be "updated" and still exposed. Chrome reopens your tabs after a relaunch, so you lose nothing.

For people who run IT at a company: the CISA deadline of November 24, 2026 formally binds US federal civilian agencies only, but it is a sensible target for everyone else. Push 157.0.8103.50 or later through your management tool, and force a relaunch rather than waiting for staff to do it. Qualys says its scanner flags vulnerable machines under QID 389337.

Edge, Brave, Opera and Vivaldi users are affected too

Chrome is built on Chromium, an open-source project that also powers Microsoft Edge, Brave, Opera and Vivaldi. CISA's entry for this bug says it "could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."

Each of those browsers ships its own fix on its own schedule. Microsoft's Edge security notes carry an entry dated November 9 that reads: "Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix." The note does not name a CVE or a version, and at the time of writing we could not confirm a fixed Edge build. Check Settings, then About Microsoft Edge, and install whatever it offers. The same goes for the About page in Brave, Opera and Vivaldi.

Safari and Firefox use different engines and are not part of this advisory.

You can follow this bug and every other one CISA has confirmed as exploited on the live catalogue at cleus.ai/zero-days. The entry for this flaw, with its deadline and plain-English summary, is at CVE-2026-125350 on the Cleus zero-days page.

Common questions about the Chrome CVE-2026-125350 bug

Is my Chrome affected by CVE-2026-125350?

Yes, if the version is below 157.0.8103.50 on Windows, Mac or Linux. Open the three-dot menu, choose Help, then About Google Chrome, and read the number. If it shows 157.0.8103.50 or higher and you have relaunched since the update, you have the fix.

Do I need to do anything if Chrome updates automatically?

Usually one thing: restart the browser. Automatic updates download in the background, but they only take effect after a relaunch. If you rarely close Chrome, open the About page, let it check, and press the Relaunch button. Your tabs come back afterwards.

Can I get hacked just by visiting a website?

The official description says the flaw is triggered by a crafted HTML page, so a web page is the delivery route. Google has not said how victims were lured to such pages or how many were targeted. Updating removes the vulnerable code, which is why the patch matters more than trying to guess which links are safe.

What is a use-after-free vulnerability?

It is a memory mistake. A program frees a block of memory, then keeps using a leftover reference to it. If an attacker controls what fills that space next, the program can be tricked into running the attacker's instructions. It is one of the most common bug types in browsers written in C++.

Is Microsoft Edge affected by the Chrome zero-day?

Edge is built on the same Chromium code, and CISA names it among the browsers that could be affected. Microsoft's security notes dated November 9 say it knows about exploits in the wild and is working on a fix. Open About Microsoft Edge and install any update it offers.

Who is exploiting CVE-2026-125350?

Nobody has said publicly. Google confirmed that an exploit exists in the wild but has not named a group, a target or a region, and the three news outlets cited here found nothing more. Treat any confident claim about the attackers as unverified for now.

How serious is CVE-2026-125350?

It is rated High, with a CVSS score of 8.8 out of 10 according to The Hacker News. The score reflects that it can be triggered remotely through a web page. The bigger signal is that it is already in use, which is why CISA set a two-week patch deadline for federal agencies.

If your setup is unusual, such as a managed work laptop, an old operating system, or a browser not listed here, describe it to Cleus, the uncensored AI assistant, and ask what to check.

Sources

• Google Chrome Releases: Stable Channel Update for Desktop, November 9, 2026
• CISA Known Exploited Vulnerabilities catalog: CVE-2026-125350
• NVD entry for CVE-2026-125350
• BleepingComputer: Google patches eighth Chrome zero-day exploited in attacks this year
• The Hacker News: Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026
• SecurityWeek: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
• Qualys ThreatPROTECT: Google Chrome Zero-day CVE-2026-125350
• Microsoft Edge security release notes