Chrome Zero-Day Warning: Update Now as Google Confirms Eighth Exploited Flaw of 2026

Google has confirmed that attackers are already exploiting a flaw in Chrome, and the fix sits in an update many people have not installed yet. The flaw, tracked as CVE-2026-125350, is a use-after-free bug in the browser's XML code. Google released the patch on November 9, 2026, in Chrome 157, and its advisory carries the sentence no Chrome user wants to read: an exploit for this flaw exists in the wild.

This is the eighth Chrome flaw exploited as a zero-day this year, tying the total Google patched across all of 2025, with two months of the year still to go. The bug was reported by an anonymous researcher on November 6, and the patch landed three days later. That speed only helps people who install the update and restart the browser.

If you use Chrome on Windows, Mac, Linux, or Android, the fix takes about two minutes: update, then relaunch. Here is what the flaw is, who is affected, and how to check you are protected.

What the Flaw Is

CVE-2026-125350 is a use-after-free vulnerability in the part of Chrome that handles XML. The bug sits in libxslt, the library Chrome bundles to process XSLT transformations, the stylesheets that turn XML documents into readable pages. A use-after-free bug happens when software frees a block of memory and then keeps using it, and an attacker who controls the timing can turn that confusion into code running where it should not.

A crafted web page can trigger the flaw inside Chrome's renderer, the sandboxed process that draws web pages. Google rates the flaw High severity, and the NVD entry scores it 8.8 out of 10, reflecting a network attack that needs no privileges, only a visit to a malicious page.

Google has kept the technical details restricted while users update, which is its usual practice. The Chromium bug report is locked, no public exploit code has appeared, and Google has published no indicators of compromise for defenders to hunt for.

A Fast Patch, and a Worrying Count

Three days from report to patch is fast by any standard. The anonymous report arrived on November 6, and the fixed builds shipped on November 9: Chrome 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux and Android. Users on the Extended Stable channel, the slower-moving build many workplaces deploy, got version 156.0.8078.96 with the same fix.

The speed is welcome because the count is not. This is the eighth Chrome zero-day exploited in the wild during 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. Google patched eight across the whole of 2025, so 2026 has already matched that total with two months still to run.

The same Chrome 157 release fixed nine security flaws in total, including a second XML use-after-free, CVE-2026-125346, which is not known to be exploited, plus high-severity flaws in WebGL, FileSystem, GPU, Compositing, and V8. Updating closes all of them at once.

What Google Has Not Said

Google's advisory is short on the details people most want. It has not said who is exploiting the flaw, who is being targeted, or how the attacks are delivered. It has not said whether attackers are pairing this bug with a second flaw to escape Chrome's sandbox, and the SANS Internet Storm Center noted on November 10 that a sandbox escape has not been confirmed.

CISA Steps In

CISA, the US Cybersecurity and Infrastructure Security Agency, added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on November 10, 2026, and gave US federal civilian agencies until November 24 to patch. The catalog is a binding to-do list for federal agencies, and a two-week deadline for a browser flaw signals that exploitation is active and ongoing.

Private companies and home users are not bound by that deadline, but the risk is the same for them, and CISA's listing is often the moment large organizations move a browser update to the top of the queue.

Who Is Affected

Any installation of Chrome below version 157.0.8103.50 is affected, on Windows, macOS, Linux, and Android. On Windows and macOS the fixed builds are 157.0.8103.50 and 157.0.8103.51, and on Linux and Android the fixed build is 157.0.8103.50. Extended Stable users need 156.0.8078.96 or later.

The flaw is not limited to Chrome itself. The vulnerable code sits in Chromium, the open-source project Chrome is built on, so other Chromium-based browsers share it, including Microsoft Edge and Opera. At Microsoft's last update on November 9, Edge was still waiting on its fix, so Edge users should check for an update again rather than assume they are covered.

How to Update and Check

On a Windows or Mac computer, open Chrome, click the three-dot menu, then Help, then About Google Chrome. Chrome checks for an update and shows your version number. If it says 157.0.8103.50 or later, you are patched. If it downloads an update, click Relaunch when it asks. The update does nothing until the browser restarts, and that is the step people most often skip.

On Android, open the Play Store, search for Chrome, and tap Update if one is offered. Then close Chrome fully and open it again. To check the version, open Chrome, tap the three-dot menu, then Settings, then About Chrome. The version number should read 157.0.8103.50 or later. Google says the update will roll out over the coming days and weeks, which means many computers will not have it yet unless their owners check manually, so do not wait for the automatic rollout.

Frequently Asked Questions

Am I affected if I use Chrome on my phone?

Yes, if your Chrome is below version 157.0.8103.50. On Android, update Chrome from the Play Store and then close and reopen the browser. On iPhone, Chrome is built on Apple's WebKit engine rather than Chromium, so this particular flaw does not apply in the same way, but you should still keep Chrome updated through the App Store.

Is updating enough, or do I need to restart Chrome?

You need to restart it. Chrome can download the update in the background, but the old code keeps running until the browser relaunches. Open Help, then About Google Chrome, and click Relaunch when it appears. Until you do, you are still running the vulnerable version.

What if I use Edge or another Chromium browser?

The same vulnerable code is shared across Chromium browsers, so check your browser's own update page. Edge was still waiting on its fix at Microsoft's last update, so check again for a new version. Update every Chromium-based browser you use, not just Chrome.