🔍 Read the full analysis: The XML Bug Behind Chrome’s Eighth Zero-Day Of 2026 on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component that the company says is being exploited in the wild. The source counts it as Chrome’s eighth in-the-wild exploited flaw flagged by Google in 2026. Attackers, targets and technical details have not been disclosed.
Google released Chrome updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free vulnerability in Chrome’s XML component. Google says it is aware of an exploit being used in the wild, making the flaw the eighth Chrome vulnerability the company has flagged as exploited in 2026, according to a count of its release notes cited by ThorstenMeyerAI.com.
Google’s desktop security notes describe the issue as “Use after free in XML” and rate it High. The bug was reported by an anonymous researcher on November 6, according to Google’s release notes. Google shipped a fix three days later, but said the desktop update would roll out over the coming days and weeks. Its Android release was expected to become available through Google Play over the following days.
The fixed versions listed by Google are 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using the Extended Stable channel should install 156.0.8078.96 for Windows and Mac. The same release also fixes a separate XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12; Google did not say that this second flaw is being exploited.
Chrome users can check for the update through the browser menu by opening Help and then About Google Chrome. Chrome downloads an available update there, but users need to select Relaunch to apply it. On Android, users can check the Chrome listing in Google Play and install the update if it is offered.
Chrome’s XML Bug Needs a Patch
Google says a high-severity Chrome vulnerability is being exploited in the wild. Updates are rolling out, and users should install the version for their browser and platform.
What the alert confirms
The warning confirms exploitation, but not who is behind it or what the exploit can do.
Use after free in XML
CVE-2026-125350 is a high-severity bug in Chrome’s XML component.
Attack details
Google has not disclosed attackers, targets, technical details or the scale of activity.
Install the update
Check for the update and relaunch Chrome to apply it.
On desktop, open Help, then About Google Chrome. On Android, check Chrome in Google Play.
Install the offered update. On desktop, select Relaunch to finish applying it.
Organizations should confirm their update channel and install its applicable fixed version.
Fixed versions by platform
Google lists these Chrome releases as fixing CVE-2026-125350.
| Platform or channel | Fixed version |
|---|---|
| Windows and Mac | 157.0.8103.50/.51 |
| Linux | 157.0.8103.50 |
| Android | 157.0.8103.50 |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Other Chromium browsers
Each browser maker must issue its own update.
- Edge, Brave, Vivaldi and other Chromium-based browsers
- Install the version supplied by your browser maker
- A Chrome update does not itself patch other browsers
- Google’s warning does not identify attackers or targets
Why the XML Bug Needs a Patch
The immediate risk is that Google says an exploit already exists in the wild, while the patch is still rolling out. That statement confirms exploitation, but does not identify who is using the exploit or how widespread the activity is. Users should check for and install the applicable fixed version rather than assume the automatic rollout has reached their device.
A use-after-free error occurs when software releases a section of memory and later tries to use it again. Depending on how an attacker can influence the affected process, this class of flaw can cause a crash or memory corruption and may sometimes support code execution. Those are general risks associated with the bug category, not confirmed outcomes of this particular exploit. Google has not published enough technical detail to establish what the attack can do.
The release also matters beyond Chrome. Microsoft said on November 9 that it was aware of in-the-wild exploits and was working on an Edge security fix. Vivaldi’s desktop update notes said its Chromium-based release included a fix for CVE-2026-125350, while Brave listed a release based on Chromium 157.0.8103.50. Users of other Chromium-based browsers need to check their own vendor’s release information: Chrome’s update does not itself patch those products.
Products Worth Considering
BowFlex Results Series SelectTech Adjustable Dumbbells, Pair
Garmin Forerunner 935 GPS Running and Multisport Watch, Black
Withings Body Scan Smart Scale with Segmental Body Composition and ECG, Black
As an affiliate, we earn on qualifying purchases.
How Google Counted Eight Flaws
The count of eight refers to flaws that Google flagged in 2026 with wording that an exploit existed “in the wild,” not to every Chrome security issue fixed this year. ThorstenMeyerAI.com says it counted the notices in Google’s Chrome Releases blog; SecurityWeek, The Hacker News and BleepingComputer were also cited as reporting the same total.
The seven earlier vulnerabilities listed in the source are CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; and CVE-2026-85046 and CVE-2026-87491 in September. The source’s count says four of the eight were in V8, Chrome’s JavaScript engine. That historical tally provides context for the new alert but does not establish whether the vulnerabilities are connected or whether they were used by the same attackers.
Google’s notes also list platform-specific fixes, and the source reported no Chrome for iOS or ChromeOS post mentioning this vulnerability as of November 10. That is a snapshot of the release information available on that date, not confirmation that those platforms are unaffected.
““Google is aware that an exploit for CVE-2026-125350 exists in the wild.””
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not publicly explained how the exploit works, which part of Chrome’s XML handling is affected, or what attackers can achieve with it. The company has also not identified the attackers, reported targets or confirmed the scale of the activity. The source says Google is keeping technical details restricted for now.
It is also unclear from the available release notes whether the exploit has been used in targeted attacks or broader campaigns. Google’s warning establishes that exploitation is occurring, but it does not answer those questions. For Chrome on iOS and ChromeOS, the source found no relevant release post as of November 10; readers should not treat the absence of a cited post as proof that those versions are safe or affected.
Vendor status outside Chrome can change quickly. The source’s November 10 check found no Edge fixed version listed, while it reported updates from Vivaldi and Brave and no Opera desktop post mentioning the flaw. Those are time-specific findings, not a complete or current inventory of all browser releases.
Check for Vendor-Specific Updates
Chrome users should check their browser’s About page, install the version listed for their platform, and relaunch the browser to complete the update. Android users should check Google Play as the release becomes available. Organizations should confirm whether they use the standard or Extended Stable channel and apply the corresponding fixed version.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should follow their browser maker’s security notices and install that vendor’s release when available. Google’s Chrome version numbers do not confirm that another browser has received the patch. Further information may emerge through vendor advisories or revised security notes, but Google has not announced a timeline for publishing additional exploit details.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit for it exists in the wild.
Which Chrome versions fix the vulnerability?
Google lists versions 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac.
How do I apply the Chrome update?
On desktop, open Chrome’s menu, choose Help and then About Google Chrome, and relaunch after the update downloads. On Android, check Chrome’s page in Google Play and tap Update if the release is available.
Does the warning affect other Chromium-based browsers?
Potentially, but each browser maker must issue its own update. Check the vendor’s security notes rather than assuming a Chrome patch has updated Edge, Brave, Vivaldi, Opera or another Chromium-based browser.
Who is exploiting the bug, and who is being targeted?
Google has not identified the attackers or targets, and it has not described the exploit’s technical details or scope. Those points remain unknown from the available information.
Source: ThorstenMeyerAI.com
