The Chrome flaw CVE-2026-125350 is already being exploited in attacks. Google closed the bug with the Stable channel update of 9 November 2026 and said only one thing about the attacks: it is aware that an exploit for CVE-2026-125350 exists in the wild. A day later, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its catalog of actively exploited flaws. Anyone using Chrome should check that at least version 157.0.8103.50 is installed. Users of Microsoft Edge on the desktop face an extra hurdle: as of the morning of 12 November, Microsoft had not yet released a desktop fix.
As usual, Google is holding back technical details. What is known is the bug class, the affected component and the fixed versions. That is enough to decide what to do now.
CVE-2026-125350: what Google confirms
In the official Chrome Releases blog, Google describes CVE-2026-125350 as a “use after free in XML” rated “High”. According to the entry, the bug was reported twice: on 12 October 2026 by Arni Hardarson (Neonix Security) and on 6 November 2026 by an anonymous reporter. The bug tracker entries are restricted. Google cites its standard note that details stay restricted until a majority of users have updated, and that restrictions are kept if the bug sits in a third-party library that other projects also depend on and have not yet fixed.
A use-after-free occurs when a program frees memory but later still accesses it through a stale pointer. If an attacker manages to fill the freed region with data of their choosing, a crash can turn into code execution. In browsers, such bugs are typically reachable through crafted web pages: the victim only has to open a page that triggers the vulnerable code path. Google has not said whether the attackers in this case also use a second flaw to escape the Chrome sandbox. There is no information on victims, targets or threat actors either.
Affected versions and updates
CVE-2026-125350 is fixed in the following desktop Chrome versions:
- Windows and macOS: 157.0.8103.50 or 157.0.8103.51
- Linux: 157.0.8103.50
As usual, Google is rolling out the update gradually “over the coming days/weeks”. If you do not want to wait, open Settings → About Google Chrome; the browser checks for the new version immediately and then asks for a relaunch. The fix only takes effect after that relaunch – a step that is easily missed in practice, because many people keep their browser open for days.
The update contains nine security fixes in total. The blog entry lists eight of them with a CVE number: besides the zero-day, five more bugs rated “High” in WebGL (CVE-2026-125345), FileSystem (CVE-2026-125347), Compositing (CVE-2026-125343), GPU (CVE-2026-125348) and the V8 JavaScript engine (CVE-2026-125344), plus two medium-severity bugs in the GPU component (CVE-2026-125349, CVE-2026-125342). Google reports no exploitation for any of these other bugs.
CISA deadline and the state of Edge
CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities Catalog on 10 November 2026. US federal civilian agencies must remediate it by 24 November 2026. Whether the flaw is used in ransomware campaigns is listed as “Unknown”. The deadline is not binding for organisations outside the US federal government, but it is a sensible yardstick: an actively exploited browser flaw does not belong in the next regular patch cycle.
Because the bug sits in the Chromium code base, other Chromium-based browsers are affected as well until they ship the fix. In its Edge security release notes, Microsoft wrote under 9 November that it is aware of the exploits and is working on a fix. On 11 November, Edge for Android version 157.0.4341.53 followed with the fix for CVE-2026-125350. For desktop Edge, no new version containing this fix was listed when we checked on the morning of 12 November; the most recent Stable version mentioned, 157.0.4341.42, dates from 5 November and therefore predates the Chrome fix. Administrators should keep an eye on that page and roll out the next Edge update quickly.
For other Chromium browsers such as Brave, Opera or Vivaldi, we did not find vendor statements on CVE-2026-125350. If you use them, check the release notes to see whether they are built on Chromium 157.0.8103.50 or later.
Context: another Chrome zero-day this year
Trade publications such as BleepingComputer and SecurityWeek count CVE-2026-125350 as the eighth actively exploited Chrome zero-day of 2026. The pattern is familiar: Google confirms exploitation but gives no details, and attacks on browser memory bugs have often targeted selected individuals rather than the general public. That is no reason to relax. Once a patch is public, the code changes can be compared to work out where the bug is – and attackers like to use exactly that gap between patch and installation. We recently described how quickly that can happen in our piece on the GLM 5.3 patch-gap experiment with Firefox.
The two separate reports are notable: one researcher had already reported the bug in mid-October, and the anonymous report came almost four weeks later, three days before the update. The entry does not say whether the anonymous report is what alerted Google to the ongoing exploitation.
What admins and users should do now
- Check the version: open
chrome://settings/helpin Chrome. It should show 157.0.8103.50 or later; then relaunch the browser. - Managed environments: use group policy or your MDM to verify that automatic updates are enabled and that a forced relaunch after updates is configured. Follow up on devices with long-running browser sessions.
- Watch Edge: until Microsoft ships the desktop fix, Edge on Windows and macOS remains vulnerable. This also applies to applications that use Edge WebView2 to render web content from untrusted sources – their protection also depends on the Edge update.
- Other Chromium browsers: check Brave, Opera, Vivaldi and others for their Chromium base and update them.
- Review your inventory: the flaw lands in a week with several exploited vulnerabilities, including the Outlook zero-day from Patch Tuesday November 2026 and the GPUStack flaw CVE-2026-102895. If you are patching anyway, do not leave browsers at the bottom of the list.
What remains open
Three questions are unanswered for now: who is exploiting the flaw, against whom, and whether an exploit chain with additional bugs is required. It is also unclear whether the XML bug sits in code that other projects outside Chromium use as well – Google’s note on third-party libraries is boilerplate, not evidence of that. Once Google opens the bug entries or Microsoft releases the desktop fix for Edge, we will update this article.
This article reflects the situation as of 12 November 2026, 09:45 CET.
