Chrome zero-day CVE-2026-125350: update to 157.0.8103.50

Another Chrome zero-day, another relaunch. Google shipped an emergency fix on November 9 for CVE-2026-125350, a use-after-free bug in Chrome's XML component, and says an exploit for it already exists in the wild. BleepingComputer counts it as the eighth exploited Chrome zero-day of 2026. If your team runs your store, your bank and your inbox in Chrome, this one is yours.

What actually happened

• The bug. CVE-2026-125350 is a high-severity use-after-free in Chrome's XML handling. In Google's words, quoted by BleepingComputer: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."
• Who found it. An anonymous researcher reported it on November 6, SecurityWeek reports. Google patched it three days later.
• The fixed versions. Chrome 157.0.8103.50/.51 on Windows and Mac, and 157.0.8103.50 on Linux, per SecurityWeek. Google's advisory is the November 9 stable channel update.
• What else is in the update. SecurityWeek says the release patches nine bugs in total. Besides the zero-day, that includes six more high-severity flaws in WebGL, FileSystem, Compositing, GPU, V8 and XML.
• What we don't know. Google hasn't said who is exploiting the bug or who the targets are. That's normal: it keeps bug details locked until most users update. As of SecurityWeek's report, CISA hadn't added it to its Known Exploited Vulnerabilities catalog.

Why it matters for your business

A browser bug is an every-account bug. The tab with your Shopify admin, the tab with your bank and the tab with your email all sit in the same browser. The fix exists, but it doesn't take effect until Chrome restarts. Most people leave Chrome open for weeks, so most people stay exposed for weeks.

Our patch routine for a small team:

1. Check the version now. Open chrome://settings/help. It should show 157.0.8103.50 or later. Then click Relaunch.
2. Do every machine. That means the front-desk PC, the shared laptop and the warehouse terminal that nobody owns. Those are the ones that drift.
3. Cover the other Chromium browsers. Edge, Brave and Opera run on the same engine but ship fixes on their own schedules. Check each vendor's release notes. Don't assume a Chrome fix covers them.
4. Force restarts if you manage devices. Chrome's RelaunchNotification policy, pushed from the Google Admin console or Intune, sets a restart deadline. Eight zero-days in ten months is a cadence, not a fluke. Plan for it.

Sources: BleepingComputer, SecurityWeek, Chrome Releases.