Chrome Zero-Day CVE-2026-125350 Fixed in 157

Google has shipped a Chrome 157 desktop update that fixes an exploited Chrome zero-day in the browser’s XML code. The 9 November 2026 stable-channel note says version 157.0.8103.50/.51 is rolling out for Windows and Mac, and 157.0.8103.50 for Linux, “over the coming days/weeks.” The update includes nine security fixes. Google is “aware that an exploit for CVE-2026-125350 exists in the wild.”

The useful step for readers is immediate and unglamorous: install the build and relaunch Chrome so the patched process is the one actually running. A downloaded package that has not been restarted still leaves the old binary in memory. HKCERT, in a 10 November bulletin, rates the issue “Extremely High Risk” because CVE-2026-125350 is being exploited in the wild.

The exploited XML bug is CVE-2026-125350, not its neighbour

Google describes CVE-2026-125350 as a high-severity use-after-free in XML, reported by an anonymous researcher on 6 November 2026. The same release also lists a separate high-severity XML use-after-free, CVE-2026-125346, reported on 12 October by Arni Hardarson of Neonix Security. Adjacent CVE numbers and a shared component do not make them the same flaw. Google’s in-the-wild sentence names only CVE-2026-125350.

Google has published no details of the attacks, no victim set and no attacker. It also says access to bug details and links “may be kept restricted until a majority of users are updated with a fix.” That restriction is the usual posture when a stable-channel exploit is already circulating; it is not a second confirmation of who is using it.

As of CISA’s Known Exploited Vulnerabilities catalogue version 2026.11.09, CVE-2026-125350 is not listed. The NVD page for the CVE has no published record or CVSS score yet. Those gaps matter for federal ticketing; they do not change the vendor advice to move to 157.0.8103.50/.51.

SecurityWeek and The Hacker News both count this as the eighth exploited Chrome zero-day of 2026. That tally is theirs, not Google’s release note.

Update, relaunch, then watch other Chromium browsers

Chrome’s staged desktop roll-out can take days or weeks, so waiting for the browser to catch the build on its own schedule is a slower path than checking the running version and relaunching once 157.0.8103.50 or .51 is present. The same advice applies on UK and other desktops: the build numbers are global.

The Chrome 157 security drop sits in a year already crowded with browser-engine patching. TSN has covered earlier Chrome work from a different angle, including Anthropic’s claim that an unreleased model found 62 Chrome flaws, all later patched and Google’s Big Sleep work on V8 bugs. Those stories were about research pipelines. This one is about a fix that needs to be running today.

Other Chromium browsers—Microsoft Edge, Brave, Opera and Vivaldi among them—ship their own releases on their own calendars. They should be watched for equivalent patches rather than assumed to inherit Chrome 157 the same day.

The absence of a KEV row also stands in contrast to the catalogue additions TSN covered this week, such as IBM Aspera Faspex CVE-2026-123218, FreeSWITCH CVE-2026-116779 and GPUStack CVE-2026-102895. A missing KEV entry is not a finding that the exploit is unused; it is only a finding that CISA has not yet listed it.

A missing score does not make a running browser safe

The operational error in a week like this is to treat NVD and KEV as the start line. Google has already said an exploit exists. HKCERT has already put the risk at the top of its scale. The patched channel is in the release notes. Until a majority of users have the new build, Google is withholding the bug graph that would help attackers more than it would help a helpdesk.

Two other mistakes travel with that delay. The first is conflating CVE-2026-125350 with CVE-2026-125346 because both are XML use-after-free bugs in the same update; only the former is the in-the-wild item Google named. The second is patching Chrome and forgetting the Chromium family that shares the engine. Edge and Brave users who wait for a bundled monthly drop are on a different clock from the Chrome stable note published on 9 November.

Fleet owners should verify the running version, not only the installer cache, and should treat kiosks, shared PCs and headless Chrome jobs as part of the same pass. The next documents to watch are a CISA KEV add, an NVD record with a CVSS vector, and the first Edge, Brave, Opera or Vivaldi release notes that cite CVE-2026-125350. Until those land, the instruction stays short: update Chrome 157 and relaunch.