What happened
On November 9, 2026, Google released a security update for Chrome on desktop. According to The Hacker News, it fixes nine vulnerabilities, including CVE-2026-125350, a flaw in the part of the browser that handles XML.
According to The Hacker News, Google has acknowledged that it is aware of an exploit for this flaw in the wild. It has not shared who is using it or against whom. Google says it may keep access to technical details restricted until most users have installed the fix.
The US agency CISA added the flaw to its catalog of actively exploited vulnerabilities on November 10, 2026. The EU vulnerability database EUVD, run by ENISA, also lists it as exploited since November 10, 2026. According to The Hacker News, an anonymous researcher reported the bug on November 6, 2026, and it is the eighth actively exploited Chrome zero-day fixed this year.
Why it is dangerous
This is a “use-after-free” bug, meaning the program uses memory it has already released. Think of a cloakroom: you hand back your ticket, the hook is freed and someone hangs a different coat on it. If the program still reaches for the original hook, it gets someone else’s coat. An attacker can arrange things so the program processes the attacker’s data instead of its own.
According to the NVD description, a remote attacker can run their own code inside the browser sandbox using a crafted HTML page. No login is needed. The victim only has to open the page, for example from a link in an email, a compromised website or a malicious ad.
The sandbox is an isolated environment that limits what code in the browser can do to the rest of the computer. To fully take over a machine, attackers typically chain a bug like this with a second one that escapes the sandbox. Even access inside the browser is serious, though: it can expose logged-in sessions, passwords and company web apps.
The flaw has a CVSS score of 8.8 out of 10, which is high severity, and Google itself rates it “High”. The CISA KEV catalog lists vulnerabilities with confirmed exploitation. US federal agencies must fix this one by November 24, 2026. CISA does not yet say whether ransomware groups are using it.
Who is affected
Google Chrome for Windows, macOS and Linux before version 157.0.8103.50 is affected. That covers practically every company whose staff use Chrome for email, web apps or online banking.
The Hacker News advises users of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera and Vivaldi, to apply fixes as soon as their vendors release them. Neither Google nor The Hacker News lists specific fixed versions for those browsers.
- employee workstations and laptops
- terminal and RDP servers where users log in and browse the web
- machines where Chrome does not update itself, for example because of policies or missing permissions
How to check if you are affected
The easiest way is to open chrome://settings/help in Chrome, or go to More > Help > About Google Chrome. It shows the current version. Note that this page also triggers an update check.
To only read the version without touching the browser, use these commands. On Linux:
google-chrome --versionOn Windows (the version the current user last ran):
reg query "HKCU\Software\Google\Chrome\BLBeacon" /v versionOn macOS:
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --versionIf you manage many machines, your device management tool or the Google Admin console can show versions across the fleet. Anything below 157.0.8103.50 is vulnerable.
How to fix it
The fix is Chrome 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, or later. Google has not published a workaround, so updating is the only real protection.
- Go to More > Help > About Google Chrome and let the update download.
- Click Relaunch. The fix does not take effect until the browser restarts.
- On Linux, update the
google-chrome-stablepackage through your distribution’s package manager. - In a company, check that policies are not blocking automatic updates and force a browser restart, for example through Group Policy or the Google Admin console.
- Then update Edge, Brave, Opera, Vivaldi and other Chromium-based browsers as their vendors release fixes.
Order: start with people who handle sensitive data and outside email (management, accounting, IT admins), then terminal servers, then everyone else. Since the flaw is already being exploited, do not wait for your regular maintenance window.
What if you may already be compromised
Neither Google nor CISA has published specific indicators of compromise, such as addresses, files or other traces of the attack. Any check can therefore only be general.
- antivirus or EDR alerts from recent days, especially about processes started by the browser
- unknown Chrome extensions and unexpected downloaded files
- suspicious sign-ins to email and company cloud services, including from unusual countries
- new or unknown user accounts and scheduled tasks on the computer
If you find any of these, or suspect someone opened a malicious link, disconnect the computer from the network, change passwords from another device and end active sessions. If management or accounting may have been targeted, bring in an incident response specialist.