Chrome Zero-Day Exploited in the Wild: Check and Update Now

At a glance - position as of 12 November 2026

Google's Stable desktop update of 9 November 2026 fixes CVE-2026-125350, a high-severity use-after-free in the XML component of Chrome. Google says it is aware that an exploit for this flaw exists in the wild. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue on 10 November 2026 as "Google Chromium Use-After-Free Vulnerability", with a due date of 24 November 2026 for US federal agencies. That due date does not bind UK organisations, but it is a fair indication of how quickly CISA expects this to be dealt with.

The immediate action is simple: get every Chrome installation to a fixed build and make sure the browser has actually been restarted. Browsers built on the same Chromium code, including Microsoft Edge and Opera, may also be affected and need their own vendor's update.

• Fixed Chrome Stable builds: 157.0.8103.50 or 157.0.8103.51 on Windows and Mac, 157.0.8103.50 on Linux.
• Fixed Chrome Extended Stable build: 156.0.8078.96 (reported for Windows and Mac).
• Chrome for Android: Chrome 157 with the same security fixes as desktop, reported as 157.0.8103.50. Update through Google Play.
• Exploitation: reported by Google and listed by CISA. The attackers, their targets and the delivery method have not been made public.
• Known workaround: none located in the sources checked. Updating is the remedy.

Update Chrome on your own computer

Chrome normally updates itself, but a rollout can take days to reach everyone, and a downloaded update does nothing for a browser that has been left running for weeks. This takes a couple of minutes.

1. Open Chrome, select the More menu (three dots) at the top right, then choose Help and About Google Chrome. Chrome checks for updates as soon as the page opens.
2. Read the version number shown under the Google Chrome heading. On Windows, Mac and Linux it should be 157.0.8103.50 or later. If you are on the Extended Stable channel, it should be 156.0.8078.96 or later.
3. If a Relaunch button appears, select it. Chrome restores your open tabs and windows after the restart, although Incognito windows are not reopened. The fix only protects you once Chrome has restarted.
4. On Linux, update the Chrome package through your distribution's package manager, then restart the browser.
5. On Android, open Chrome's page in Google Play and install any pending update. On a Chromebook, update ChromeOS itself, since that is what updates the browser (see the note on ChromeOS below).
6. To confirm success, return to About Google Chrome. You should see the fixed version number and no prompt to relaunch.

Closing the gap across a managed fleet

For IT administrators, the version that matters is the one running right now, not the one installed on disk. Devices that have downloaded the update but not restarted the browser are still exposed, and long-lived sessions on shared or kiosk machines are the usual culprits.

1. Use your endpoint management or software inventory tool to list Chrome versions. Flag any Stable install below 157.0.8103.50 and any Extended Stable install below 156.0.8078.96.
2. Push or permit the update through your normal deployment route rather than waiting for Google's staged rollout to reach each device.
3. Find devices where the update has been staged but the browser has not been relaunched. Prompt users to restart Chrome, or use your tooling's relaunch controls if you have them.
4. Include Android devices that run Chrome under mobile device management and any Chrome installs outside your standard image, such as personal-use profiles on shared machines.
5. Re-run the inventory after users have restarted and chase any stragglers. Google has not published indicators of compromise or detection signatures for this flaw, so confirming versions is the main control available.

Microsoft Edge and other Chromium browsers

Chromium is the open-source browser engine underneath Chrome, Edge, Opera, Brave and Vivaldi. CISA's KEV entry says Edge and Opera may also be affected. Each vendor ships fixes on its own timetable, so Chrome being patched tells you nothing about the others.

On Microsoft's Edge security release notes, an entry dated 9 November 2026 says Microsoft is aware of exploits in the wild and is working on a security fix. An entry dated 11 November 2026 says Microsoft Edge for Android 157.0.4341.53 contains a fix for CVE-2026-125350. When we checked on 12 November 2026, no desktop Edge release was listed as addressing this CVE: the latest desktop Stable entry was 157.0.4341.42, dated 5 November 2026. Treat desktop Edge as unpatched until Microsoft's release notes say otherwise, then update through Settings and About Microsoft Edge and restart it.

If desktop Edge is still waiting on its fix, one reasonable interim step, and this is engineering judgement rather than vendor guidance, is to make sure staff who browse untrusted sites are using an updated Chrome. For Opera, Brave, Vivaldi and any other Chromium-based browser, check the vendor's own release notes for this CVE before assuming you are covered.

ChromeOS needs separate watching. Reporting around the release noted that no ChromeOS Stable update listing this CVE had been posted when those articles were written, so check Google's Chrome Releases blog for a ChromeOS entry rather than assuming Chromebooks are already fixed.

What is known about the risk, and what is not

A use-after-free is a memory-handling error: the browser keeps using a piece of memory after it has been released, which an attacker can sometimes steer to run their own code. CISA's description says a remote attacker could run code inside the browser's sandbox by luring someone to a crafted webpage. The sandbox is the restricted environment that limits what a compromised web page can do to the rest of the computer.

Google's advisory does not describe this as a full remote code execution flaw, and no sandbox escape has been confirmed in the sources we checked. Some press coverage is looser on this point. Flaws like this are commonly paired with a second vulnerability to get past the sandbox, but there is no public evidence either way for this particular exploit, which is a good reason not to treat the sandbox as a safety net.

The anonymous report reached Google on 6 November 2026 and the fix followed on 9 November. Google has restricted the technical details while most users update. The same release contains eight further security fixes, according to secondary reporting, including a second high-severity XML use-after-free, CVE-2026-125346. The sources we checked do not report that one as exploited.

Installing the update closes the hole but cannot undo a compromise that already happened. With no public indicators of compromise, there is nothing specific to hunt for. If a device behaved suspiciously before it was updated, treat that as an ordinary security concern and escalate it to whoever handles incident response.

Real-world reporting

No victim, campaign or threat group has been publicly tied to CVE-2026-125350 in the sources we checked. CISA lists known ransomware campaign use as unknown. A KEV entry shows that exploitation has been observed, not who was affected, so we are not drawing conclusions about targets.