🔍 Read the full analysis: Which Chrome Version Fixes The XML Zero-Day? Here’s How To Check on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google’s November 9 Chrome update fixes CVE-2026-125350, a high-severity XML use-after-free bug that Google says is being exploited in the wild. Most desktop users need Chrome 157.0.8103.50 or .51, while Android and Extended Stable have separate version numbers. Check for the update and relaunch Chrome; details about the attacks remain restricted.
Google released a Chrome security update on November 9 that fixes CVE-2026-125350, a high-severity use-after-free flaw in Chrome’s XML component. Google says an exploit for the bug exists in the wild, so users should check for the patched version and relaunch the browser rather than assume the update has arrived automatically.
Google’s release notes list Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. The Android release is Chrome 157, version 157.0.8103.50. Organizations using the Extended Stable channel should look for 156.0.8078.96 for Windows and Mac. Google says desktop updates will roll out over the coming days and weeks; Android availability through Google Play is expected over the next few days.
To check Chrome on a computer, open the three-dot menu, select Help, then About Google Chrome. The browser checks for an update there; if one downloads, choose Relaunch to apply it. On Android, check Chrome’s listing in Google Play for an Update button. The version number is also listed in Chrome under Settings and About Chrome. A downloaded update does not take effect until the browser restarts.
The same desktop release fixes eight security issues, according to Google’s notes. Another XML use-after-free, CVE-2026-125346, is also included; Google does not say that it is being exploited. The reported flaw was submitted anonymously on November 6, and Google released its fix three days later. Google has restricted technical details while the issue is being addressed.
Which Chrome Version Fixes the XML Zero-Day? Here’s How to Check
Google says attackers are exploiting an XML flaw. Check your browser’s version, install the update, and relaunch to apply the fix.
Find the patched version
Android has a separate version number; check Chrome in Google Play or in the app settings.
| Platform or channel | Version to check |
|---|---|
| Windows and Mac | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | Chrome 157 (157.0.8103.50) |
| Extended Stable, Windows and Mac | 156.0.8078.96 |
Install and apply the update
A downloaded update does not take effect until Chrome restarts.
Open the three-dot menu, choose Help, then About Google Chrome.
Look for an Update button on Chrome’s Google Play listing, or check Settings and About Chrome.
Choose Relaunch after the update downloads to apply the fix.
What Google has confirmed
CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component.
- Google says an exploit exists in the wild.
- The November 9 update also fixes eight security issues.
- A second XML use-after-free, CVE-2026-125346, is included.
- How the exploit works or when attacks began.
- Who may have been targeted or how widespread attacks are.
- Whether every Chrome user has been exposed or compromised.
Why the XML Fix Needs Prompt Attention
The main reason to check now is Google’s statement that the vulnerability is already being exploited. The company has not described the attacks or identified victims, but the in-the-wild notice means this is not only a theoretical software defect. Users who have not received the update may still be running an affected version while the rollout continues.
Google describes the bug as a use-after-free error in XML. In general, this type of memory-management flaw occurs when software uses memory after it has been released. The precise consequences depend on how a flaw can be reached and exploited; Google has not published details that establish what an attacker can do with this specific bug. The Hacker News reported that use-after-free issues can cause data corruption or crashes and, in some cases, enable code execution, but that general description should not be treated as a confirmed outcome for this vulnerability.
The update also matters beyond Google Chrome. Other browsers based on Chromium do not necessarily receive Google’s Chrome update at the same time: their developers must release and distribute their own builds. Users of those browsers need to check the relevant vendor’s release information, not rely on Chrome’s version number or update status.
Popular right now
Dyson Airsmooth Styling Brush
De'Longhi Magnifica Start Fully Automatic Espresso Machine with Milk Frother, Silver
Shark AI Ultra Robot Vacuum with Matrix Clean Navigation, Self-Empty Base, HEPA Filtration, Pet Hair Friendly, Wi‑Fi, Dark Grey
As an affiliate, we earn on qualifying purchases.
Patch Timeline and Browser Coverage
Google’s Stable Channel release notes say an anonymous researcher reported CVE-2026-125350 on Friday, November 6. The fixed desktop release followed on Monday, November 9. Google has not said when the vulnerability was first exploited, how long attacks may have been underway, or who discovered the exploitation.
As of November 10, the source reports different update statuses among Chromium-based browsers. Microsoft said it was aware of the in-the-wild exploits and was working on an Edge security fix, but had not listed a fixed version. Vivaldi’s desktop 8.3 update moved to Chromium 156.0.8078.99 and said it included a fix for the CVE. Brave’s release page listed version 1.99.56, based on Chromium 157.0.8103.50, though its release text did not name the vulnerability. The source found no Opera desktop update mentioning the flaw at that time.
The source counted this as the eighth Chrome flaw in 2026 for which Google’s release notes said an exploit existed in the wild. That count is based on Google’s own posts, rather than a separate incident database. Google had not published a corresponding ChromeOS or iOS release notice mentioning this flaw as of November 10, so users of those platforms should watch for their vendor’s announcements.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
What Google Has Not Disclosed
Google has not disclosed who is behind the exploitation, who may have been targeted, or how the exploit works. Its public notice does not say when attacks began or how widespread they are. The technical details are being kept restricted, and the available information does not establish that every Chrome user has been exposed or compromised.
Patch status also differs by platform and browser maker. The release information cited here did not include a ChromeOS or iOS notice for this CVE, and the status of other Chromium-based browsers was not confirmed. In particular, the listed Edge statement described a fix as in progress rather than providing a patched version. These details may change as vendors publish updates.
Check for Vendor Patch Notices
Chrome users should check About Google Chrome or Google Play, install the update when offered, and restart the browser so the fix is active. Because Google’s desktop rollout may take days or weeks, checking again later is sensible if the patched version is not yet available.
Users of Edge, Brave, Vivaldi, Opera, and other Chromium-based browsers should consult their browser maker’s current release notes for a version that includes the fix. The statuses described above reflect information available on November 10, 2026, and should not be treated as current patch confirmation after that date. Further public information may follow when Google or the browser vendors update their advisories.
Key Questions
Which Chrome version fixes the XML zero-day?
Google lists 157.0.8103.50 or .51 for Windows and Mac, 157.0.8103.50 for Linux, Chrome 157 (157.0.8103.50) for Android, and 156.0.8078.96 for Windows and Mac on Extended Stable.
How do I check whether Chrome is updated?
On a computer, open Chrome’s three-dot menu, choose Help, then About Google Chrome. Chrome checks for updates on that page. On Android, check Chrome in Google Play. Relaunch Chrome after an update downloads to apply it.
Is Google confirming that attackers are using the flaw?
Yes. Google says an exploit for CVE-2026-125350 exists in the wild. It has not publicly explained the attack method, identified targets, or said how widespread the exploitation is.
Are Edge and other Chromium browsers patched too?
Not automatically when Chrome updates. Each browser maker issues its own builds. As of November 10, the source reported Vivaldi had named a fix, Brave had a release based on the patched Chromium version, and Microsoft was still working on an Edge fix. Check your browser vendor’s latest release notes.
Source: ThorstenMeyerAI.com
