🔍 Read the full analysis: Chrome’s Eighth Zero-Day Of 2026: What The XML Flaw Means on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9 for CVE-2026-125350, a high-severity use-after-free flaw in its XML component. Google says an exploit is being used in the wild, making this the eighth Chrome vulnerability it has flagged as exploited in 2026, according to a count of its release notes. The attacker, targets and exploit details are not public.
Google released Chrome updates on November 9 to fix CVE-2026-125350, a high-severity use-after-free bug in the browser’s XML component that the company says is being exploited in the wild. The flaw is the eighth Chrome vulnerability flagged as exploited in 2026, based on a count of Google’s security release notes, and users should check that their browser has updated and restarted.
Google described the issue as “Use after free in XML” and rated it High. A use-after-free bug occurs when software continues to use a memory area after it has been released; depending on the circumstances, such errors can cause crashes or potentially allow more serious code execution. Google has not said which part of Chrome’s XML handling is affected or published details of how the exploit works. The Hacker News reported that this class of bug can lead to data corruption, crashes or arbitrary code execution, but that is a general description, not confirmation of what this vulnerability enables.
Google’s release notes list Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Chrome 157, version 157.0.8103.50, for Android. The Extended Stable channel for Windows and Mac is listed at 156.0.8078.96. Google said desktop updates would roll out over the coming days or weeks; the Android release was expected on Google Play over the next few days. Users can check a desktop version through Chrome’s menu under Help and About Google Chrome, then relaunch the browser after installation. Android users can check Google Play for an update.
The same desktop release fixes another XML use-after-free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google has not said that this second flaw is being exploited. For other Chromium-based browsers, Google’s Chrome update alone does not confirm protection: each browser maker must issue its own release.
Chrome’s XML Flaw What Users Need to Know
Google says an XML vulnerability is being exploited in the wild. Check for your browser’s security update and restart after installing it.
What the flaw means
A use-after-free bug can cause crashes and, depending on circumstances, may allow more serious code execution.
Chrome XML component
Google describes CVE-2026-125350 as “Use after free in XML.”
Attack details
Google has not identified attackers or targets, or explained how the exploit works.
Check your browser
Updates roll out in stages, so check your browser vendor’s release information.
On desktop, open Help and About Google Chrome. On Android, check Google Play.
Restart Chrome after installing so the update takes effect.
Edge, Brave, Vivaldi and other Chromium browsers need their own vendor updates.
Update coverage varies
Google’s Chrome patch does not confirm protection in other Chromium-based browsers.
| Browser | Reported status |
|---|---|
| Chrome | Updates released; rollout in progress |
| Vivaldi | Desktop update said to include the fix |
| Edge | Microsoft said it was working on a fix |
| Brave | Listed release based on Chromium 157.0.8103.50 |
Updates Must Reach Chromium Browsers
The disclosure that an exploit is already being used makes the Chrome patch more urgent than a routine security correction. Google has not explained the scope of the attacks, but users of vulnerable versions may face risk until they receive and install a fix. Because the update is rolling out in stages, checking manually can help users see whether it is available rather than waiting for the automatic rollout.
The issue also affects the wider Chromium ecosystem. Microsoft said on November 9 that it was aware of the exploits and working on an Edge security fix, but its cited release notes did not list a fixed version at that time. Vivaldi said its desktop update included a fix for CVE-2026-125350, while Brave’s listed release was based on Chromium 157.0.8103.50, though its release text did not name the CVE. Users should follow the update status from their own browser vendor instead of assuming Chrome’s fix has already reached them.
The count of eight exploited Chrome flaws is a measure of what Google disclosed in its release notes, not a measure of the number of attacks, victims or severity across the year. It signals repeated disclosures of actively exploited vulnerabilities, but the available material does not establish whether the incidents are linked or whether a particular user group is being targeted.
Products Worth Considering
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Jackery Explorer 1000 v2 Portable Power Station, 1070Wh, 1500W
As an affiliate, we earn on qualifying purchases.
How Google Counted Eight Flaws
The November 9 update followed a report submitted by an anonymous researcher on November 6, according to Google’s release notes. Google’s three-day interval from report to release is confirmed by those dates; the company has not described its investigation or the development process beyond publishing the fixes.
The eighth-flaw figure comes from counting 2026 posts on Google’s Chrome Releases blog that say the company is aware of an exploit in the wild. The list includes CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; CVE-2026-85046 and CVE-2026-87491 in September; and CVE-2026-125350 in November. SecurityWeek, The Hacker News and BleepingComputer reported the same total, according to the source material. Four of the eight were in V8, Chrome’s JavaScript engine; the source does not establish a common cause or campaign.
““Google is aware that an exploit for CVE-2026-125350 exists in the wild.””
— Google Chrome security release notes
Attack Scope Remains Undisclosed
Google has not disclosed who is behind the attacks, who has been targeted or how the exploit works. The company is restricting technical details for now, so it is not possible from the available release notes to assess the attack’s reach, whether exploitation requires particular conditions, or whether it has led to confirmed compromises.
Update coverage also varies by browser and platform. As of November 10, the source material found no Chrome for iOS or ChromeOS release note mentioning this flaw. Microsoft had not yet listed a fixed Edge version in the cited notes, and the cited Opera desktop updates did not mention it. Those observations describe the release information available at that time; they do not prove that no fixes or advisories were issued elsewhere.
Check for Vendor Security Releases
Chrome users should install the version listed for their platform and relaunch the browser so the update takes effect. Since Google said the desktop rollout could take days or weeks, users who do not yet see it can check again later. Android users can look for Chrome in Google Play and confirm the installed version in the app’s About Chrome settings.
Users of Edge, Brave, Vivaldi, Opera and other Chromium-based browsers should monitor their vendor’s security notes for a release that addresses CVE-2026-125350. The next useful updates will clarify which products and platforms have received fixes. Google may also release more technical information, but no timetable or further disclosure is confirmed.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit exists in the wild but has not publicly detailed the affected code or what the exploit can do.
Which Chrome versions include the fix?
Google lists version 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Windows and Mac Extended Stable. The rollout was still in progress as of November 10, 2026.
Does the flaw affect other Chromium browsers?
Other browsers built on Chromium need their vendors to ship their own updates. Vivaldi said a desktop update included the fix; Microsoft said it was working on an Edge fix. Users should check their browser maker’s current release notes rather than assume Chrome’s patch applies.
Why is this called Chrome’s eighth zero-day of 2026?
A count of Google Chrome Releases posts found eight 2026 vulnerabilities for which Google said it was aware of exploitation in the wild. The count reflects those disclosures; it does not show how many attacks or victims there were.
What is not yet known about the attacks?
Google has not identified the attackers or targets, explained how the exploit works, or described the extent of any resulting damage. Technical details remain restricted, and the available information does not confirm whether Chrome users have been compromised.
Source: ThorstenMeyerAI.com
