🔍 Read the full analysis: Attackers Are Using A Chrome XML Bug: Find The Version You Need on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit exists in the wild, but has not disclosed who is behind the attacks, who has been targeted or how the exploit works.
Google released Chrome security updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component that the company says is being exploited in the wild. The fixed versions vary by platform, and Google says the rollout will take days or weeks, so users should check for the update and restart the browser.
Google’s Chrome release notes describe the flaw as “Use after free in XML” and rate it High. The company’s notice says it is aware that an exploit exists in the wild, indicating the bug is being used before all users may have received the fix. Google has not publicly described the exploit or the attacks.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using Extended Stable on Windows and Mac should look for 156.0.8078.96. Google says desktop updates are rolling out over the coming days or weeks; the Android release is expected on Google Play over the next few days.
The same release includes a fix for a second XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that this second flaw is being exploited. CVE-2026-125350 was reported by an anonymous researcher on November 6, according to Google, and the fix followed on November 9.
Chrome’s XML Bug Find Your Fixed Version
Google says attackers are exploiting a high-severity Chrome flaw. Check your browser’s version and restart it after updating.
Find the fixed version
Google lists different versions by platform.
| Platform | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux and Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Update and restart
The rollout may take days or weeks on desktop; Android updates are expected over the next few days.
On desktop, open the menu, choose Help, then About Google Chrome. On Android, check Google Play or Chrome settings.
After the update downloads, select Relaunch so the fix takes effect.
Other Chromium browsers
Each browser maker must distribute its own update.
- Vivaldi said its Desktop 8.3 minor update includes the fix.
- Brave listed release 1.99.56, based on Chromium 157.0.8103.50; its release text did not name the CVE.
- As of November 10, no Edge fixed version or Opera notice mentioning the flaw was reported.
- Check your browser maker’s release notes; Chrome’s patch does not confirm other browsers are fixed.
What the bug means
A use-after-free can happen when software keeps using memory after it has been released. Google has not described what this exploit can accomplish.
High-severity XML flaw
Google says an exploit exists in the wild and calls the bug “Use after free in XML.”
A second XML fix
The same release fixes another XML use-after-free. Google’s notes do not say it is being exploited.
Why the Chrome Fix Needs Attention
The immediate concern is the combination of a high-severity browser vulnerability and Google’s statement that an exploit is already in use. Chrome is updated on a rolling schedule, so a release announcement does not mean every installation has received or activated the fix. Users should verify their installed version and relaunch Chrome after it downloads an update.
The issue may also affect people using other browsers built on Chromium, but Chrome’s release alone does not confirm that those browsers are patched. Their makers must incorporate and distribute the relevant fix. As of November 10, the supplied reporting says Microsoft had acknowledged the in-the-wild exploit and was working on an Edge fix, while Vivaldi had published a desktop update that it said includes the CVE fix. Users of other Chromium-based browsers should check their own vendor’s release notes rather than assume Chrome’s patch applies automatically.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the XML Memory Bug Works
A use-after-free flaw occurs when software continues using a block of memory after it has been released. If an attacker can influence what occupies that memory, the mistake may create an opportunity to disrupt a program or affect its execution. The Hacker News notes that this class of bug can lead to data corruption, crashes or arbitrary code execution; that is general context about the vulnerability type, not a confirmed description of what this Chrome exploit does.
XML is a structured text format that browsers handle in areas including XML documents and SVG graphics. Google has not said which part of Chrome’s XML processing is affected, and the public information does not establish what a successful attack can achieve. Google’s release notes also say this is the eighth Chrome flaw in 2026 for which it has acknowledged an exploit in the wild, based on the source article’s count of the company’s release notes. That figure is a count for the year, not a measure of how many people or devices were affected.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not identified the people or group behind the exploitation, the organizations or users targeted, or the number of attacks. The company has also withheld technical details about the vulnerability and exploit, limiting what can be independently established about how attacks work or what they can accomplish.
It is not clear from the supplied release information whether Chrome on iOS or ChromeOS is affected; the source article says it found no relevant Google release note for either platform as of November 10. The status of every Chromium-based browser is also not confirmed. Vendor release timing and fixed versions may differ, and the available reporting does not establish that all listed browsers have shipped a patch.
Check for Updates and Vendor Notices
On desktop, users can open Chrome’s three-dot menu, select Help and then About Google Chrome. Chrome checks for updates on that page; after it downloads one, users need to select Relaunch for the new version to take effect. On Android, users can check Google Play for a Chrome update and view the installed version in Chrome’s settings under About Chrome.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should consult their browser maker’s release notes for a fixed version. The source article reports that Vivaldi’s Desktop 8.3 minor update includes a fix, and that Brave listed release 1.99.56, based on Chromium 157.0.8103.50, though its release text did not name the CVE. It reported no Edge fixed version or Opera notice mentioning the flaw as of November 10. These details may change as vendors publish further updates.
Key Questions
Which Chrome versions fix CVE-2026-125350?
Google lists 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How can I tell whether Chrome has updated?
Open Chrome’s menu, go to Help > About Google Chrome and check the displayed version. If an update downloads, relaunch the browser so the fix becomes active.
What does Google mean by an exploit in the wild?
Google says it knows of an exploit for the flaw being used outside a lab setting. Its public notice does not say who is using it, who has been targeted or what the exploit does.
Are other Chromium-based browsers patched?
That depends on each browser maker’s release. The supplied information says Vivaldi had published an update it described as fixing the CVE; check other vendors’ release notes for their own fixed versions.
Source: ThorstenMeyerAI.com
