🔍 Read the full analysis: A Chrome XML Vulnerability Is In Use: How To Check For The Fix on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Google released Chrome updates on November 9, 2026, fixing nine security issues, including a high-severity XML use-after-free bug that the company says is being exploited in the wild. Check Chrome’s version and relaunch after updating; fixes for other Chromium-based browsers depend on their vendors.
Google released a Chrome security update on November 9 that fixes nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google said it is aware that an exploit for the flaw exists in the wild, making users’ update status an immediate security concern.
Google’s Stable Channel release notes identify the flaw as “Use after free in XML” and rate it high severity. The company has not described the exploit or confirmed who is using it. Google’s wording confirms reported exploitation, but does not establish how many people or organizations have been affected.
The fixed desktop versions are 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. Android’s listed version is Chrome 157 (157.0.8103.50). Organizations using Extended Stable on Windows or Mac should check for 156.0.8078.96. Google says the desktop release will roll out over the coming days or weeks and the Android build will become available through Google Play over the next few days.
To check Chrome on a computer, open the three-dot menu, select Help, then About Google Chrome. The browser checks for an update there; if one downloads, select Relaunch to finish installing it. On Android, check Google Play for a Chrome update. The version number is also listed in Chrome’s Settings under About Chrome.
Chrome XML flaw is under attack Check for the fix
Google says an exploit for a high-severity Chrome vulnerability is being used in the wild. Check your browser’s update status and relaunch after installing the fix.
Check Chrome and finish the update
Google is rolling out the desktop release over the coming days or weeks.
On desktop, choose the three-dot menu, Help, then About Google Chrome.
Chrome checks for an update on that page. On Android, check Google Play.
When the update downloads, select Relaunch to finish installing it.
Fixed Chrome versions
Compare the version shown in Chrome with the applicable fixed release.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Other Chromium browsers need their own fixes
Chrome’s update does not automatically update browsers made by other vendors.
- Microsoft said it was working on an Edge security fix.
- Vivaldi said its Chromium 156.0.8078.99 release included the patch.
- Brave listed version 1.99.56, based on Chromium 157.0.8103.50.
- Check your browser vendor’s update page and release notes.
- Install the vendor’s fixed release when available.
- Do not assume Chrome’s version number applies to another browser.
Why the Exploited XML Bug Matters
Google’s statement that an exploit is already being used distinguishes this release from a routine patch for a theoretical flaw. Until a vulnerable browser receives and applies the update, its user may remain exposed to an issue for which Google says exploit activity exists. The company has not said what an attacker must do to trigger the bug, so users should not infer a specific attack scenario from the available information.
The fix matters beyond Chrome because several other browsers are based on Chromium. Those browsers do not necessarily receive Google’s update at the same time: each vendor must ship its own release. Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should check their own browser’s update status and release notes rather than assume the Chrome version number applies.
Popular right now
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Ninja Foodi Air Fryer 10 Qt DualZone XL 6-in-1 Grey (DZ401)
KitchenAid Artisan Mini Tilt-Head Stand Mixer, 3.5 Qt, Contour Silver
As an affiliate, we earn on qualifying purchases.
How Google Describes the Vulnerability
A use-after-free is a memory-management error: software continues to use memory after it has been released. Such bugs can cause crashes or other memory corruption, and in some cases may allow code execution. Those are general risks associated with the bug class, not confirmed outcomes of this particular exploit. Google has only identified the affected area as Chrome’s XML component; it has not specified which XML-related feature or input is involved.
The vulnerability was reported by an anonymous researcher on November 6, according to Google’s release notes, and the fix was published three days later. The same update fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google has not said that the second issue is being exploited.
The source article’s review of Google’s 2026 release notes counts this as the eighth Chrome flaw this year for which Google said it knew of in-the-wild exploitation. That count describes entries in the release notes, not the number of attacks, victims or successful intrusions.
“The update will roll out over the coming days/weeks.”
— Google, in its desktop release notes
Attack Details and Browser Coverage
Google has not disclosed who is behind the exploitation, who was targeted, or how the exploit works. It has also restricted technical details about the vulnerability. The company’s statement does not provide a victim count or indicate whether attacks are widespread.
As of November 10, the source material reported that Microsoft was still working on an Edge fix, while Vivaldi had announced a release based on Chromium 156.0.8078.99 that it said included the patch. Brave’s release page listed version 1.99.56, based on Chromium 157.0.8103.50, though its release text did not name this CVE. The source found no Opera desktop post mentioning the flaw and no Chrome release notes for iOS or ChromeOS that identified it. These are time-stamped checks, not confirmation of each product’s present status.
Check for Vendor Updates
Chrome users should use About Google Chrome on desktop or Google Play on Android to check whether the relevant fixed version is available, then restart the browser after the update downloads. Google says the rollout is continuing, so a missing update may reflect its staged release rather than a confirmation that a device is protected.
Users of other Chromium-based browsers should follow their vendor’s security notices and install the vendor’s own fixed release when available. The next useful information would be a more detailed advisory from Google or browser vendors, including technical details and any further clarification about exploitation. Until then, the scope and impact of the reported activity remain unknown.
Key Questions
Which Chrome versions contain the fix?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157 (157.0.8103.50) for Android. Extended Stable users on Windows and Mac should look for 156.0.8078.96.
How do I check whether Chrome updated?
On desktop, open Chrome’s three-dot menu, choose Help, then About Google Chrome. Chrome checks for an update there. After it downloads, choose Relaunch. On Android, check Google Play for an update; Chrome’s version is also shown in Settings under About Chrome.
Does Google say the vulnerability is being exploited?
Yes. Google says it is aware that an exploit for CVE-2026-125350 exists in the wild. It has not publicly identified attackers, targets or the exploit’s technical details.
Are Edge and other Chromium-based browsers covered by Chrome’s update?
Not automatically. Browser makers must release updates for their own products. Check the specific vendor’s update page or release notes; the source material said Microsoft was working on an Edge fix as of November 10, 2026.
Source: ThorstenMeyerAI.com
