🔍 Read the full analysis: Chrome’s XML Bug Is Under Attack: How To Find The Needed Version on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google’s November 9 Chrome update fixes CVE-2026-125350, a high-severity use-after-free bug in the XML component that Google says is being exploited. Users should check for the fixed version for their platform and relaunch Chrome; other Chromium-based browsers need updates from their own vendors.
Google released a Chrome security update on November 9 that fixes CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says it is aware that an exploit for the bug “exists in the wild,” meaning the vulnerability is being used in attacks, though the company has not disclosed who is behind them or who may have been targeted.
Google’s fixed desktop versions are 157.0.8103.50 or .51 for Windows and Mac and 157.0.8103.50 for Linux. Android users should get Chrome 157 (157.0.8103.50). Organizations using Extended Stable on Windows and Mac should update to 156.0.8078.96. Google says desktop updates will roll out over the coming days or weeks, while the Android release is due on Google Play over the next few days.
To check Chrome on a computer, open the three-dot menu, choose Help, then About Google Chrome. Chrome checks for an update there; users need to select Relaunch after it downloads so the updated browser is running. On Android, check Google Play for an available Chrome update. The version number is listed in Chrome’s Settings under About Chrome.
Google’s release notes also list a second XML use-after-free flaw, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google has not said that this separate bug is being exploited. The November 9 update contains nine security fixes in total, according to the supplied source material.
Chrome’s XML Bug Is Under Attack Find the fixed version
Google says attackers are exploiting a high-severity Chrome flaw. Check your browser version and relaunch after updating.
Find your fixed version
Match the version to your platform before assuming the update is installed.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Check and apply the update
Chrome updates roll out over days or weeks, and the browser must restart to use the fix.
On desktop, choose Help from the three-dot menu, then About Google Chrome.
Let Chrome check for an update and compare the installed version with your platform’s fixed version.
Select Relaunch after the update downloads. On Android, check Google Play and find the version in Settings under About Chrome.
Chromium browsers update separately
Each browser maker distributes its own updates, so Chrome’s version number does not confirm another browser is fixed.
Fix included
The cited desktop update moved to Chromium 156.0.8078.99 and included a fix for CVE-2026-125350.
Fixed Chromium base
Release 1.99.56 was listed as built on Chromium 157.0.8103.50.
Fix in progress
Microsoft said it was working on a security fix as of November 10.
Check vendor notices
The source found no matching desktop update at that time.
Why the XML Fix Needs Attention
The update matters because Google has confirmed active exploitation, while the security details remain restricted. A use-after-free flaw occurs when software continues to use memory after it has been released. Such memory errors can cause crashes or data corruption and, depending on the circumstances, may be used to run attacker-controlled code. Google has not described the exploit’s mechanics, so the specific risk to users cannot be assessed from the public release notes alone.
The fixed version is not automatically available to every browser user at the same time. Google says rollout can take days or weeks, and a downloaded update does not take effect until the browser is restarted. People and organizations that rely on Chrome should check the installed version rather than assume the update has already arrived.
Other browsers built on Chromium also require attention, but Chrome’s version number is not a reliable way to confirm their status. Their vendors control when fixes reach their own products. Users should check the relevant vendor’s release notes and install its recommended update when available.
Products Worth Considering
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
From Friday Report to Monday Patch
Google’s Stable Channel Update for Desktop says the XML bug was reported anonymously on November 6 and the fix was published on November 9. That is a three-day interval between the report date and the release. The update notice says the fix will roll out over the coming days or weeks, making manual version checks useful while distribution continues.
The source article counts CVE-2026-125350 as the eighth Chrome flaw in 2026 for which Google has said an exploit exists in the wild. That count is based on Google’s release notes and is also reported by SecurityWeek, The Hacker News and BleepingComputer, according to the source. Four of the eight cited vulnerabilities were in Chrome’s V8 JavaScript engine.
Chromium-based browsers use the open-source project behind Chrome, but their makers package and distribute their own releases. As of November 10, the source reports that Vivaldi’s desktop update moved to Chromium 156.0.8078.99 and included a fix for CVE-2026-125350. Brave listed release 1.99.56, built on Chromium 157.0.8103.50, though its release text did not name the CVE. Microsoft said it was working on a fix for Edge; the source found no matching Opera desktop update at that time.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not disclosed who is conducting the attacks, which users or organizations were targeted, or how the exploit works. The public description does not identify the affected XML-handling feature or explain what conditions are needed for exploitation. Those details remain unknown in the material available as of November 10.
It is also unclear when every Chrome installation will receive the update, given Google’s stated rollout period. The source found no Chrome for iOS or ChromeOS release note mentioning this flaw by November 10; that does not establish whether or when a fix will be issued for those platforms. For Edge, Opera and other Chromium-based browsers, published status can change as vendors release updates.
Check for Vendor Updates
Chrome users should visit the browser’s About page, confirm that it has reached the fixed version for their platform, and relaunch after installation. Android users should check Google Play as Google makes the release available. Organizations on Extended Stable should verify that they are running 156.0.8078.96 on Windows or Mac.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should follow their own vendor’s security notices and version guidance. As of the source’s November 10 check, Microsoft had not listed a fixed Edge version, while the cited Vivaldi and Brave releases appeared to include the relevant Chromium fix. Further vendor notices and Google updates may clarify availability across platforms and provide more information about the exploitation.
Key Questions
Which Chrome version fixes CVE-2026-125350?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should use 156.0.8078.96.
How do I check whether Chrome has updated?
On a computer, open Chrome’s three-dot menu, select Help, then About Google Chrome. If an update downloads, click Relaunch to apply it. On Android, check for an update to Chrome in Google Play.
What does Google say about exploitation?
Google says it is aware that an exploit for the vulnerability exists in the wild. It has not publicly described the attacks, their operators or their targets in the release information cited here.
Are Edge and other Chromium browsers fixed too?
Not necessarily at the same time as Chrome. Each browser vendor distributes its own updates. The source reported that Vivaldi’s cited desktop update included a fix and Brave listed a release built on the fixed Chromium version; Microsoft was still working on an Edge fix as of November 10. Check your browser maker’s current release notes.
Source: ThorstenMeyerAI.com
