The Eighth One This Year: Google Patches a Chrome XML Flaw That Attackers Are Already Using

Google Chrome stable channel security update released Monday, November 9, 2026; exploited flaw reported November 6, 2026

The Eighth One This Year: Google Patches a Chrome XML Flaw That Attackers Are Already Using

Threats

NIST and the NIST Cybersecurity Framework (CSF 2.0)MITRE ATT&CK

Google released a Chrome security update on Monday fixing nine vulnerabilities, and one of them is already in use. CVE-2026-125350 is a high-severity use-after-free flaw in the browser XML component, reported by an anonymous researcher on November 6, three days before the fix shipped. Google states that it is aware an exploit for the flaw exists in the wild; it has published no severity score beyond the high rating, no account of who is exploiting it or against whom, and it is restricting bug details until a majority of users have updated. The fixed builds are 157.0.8103.50 and 157.0.8103.51 for Windows and macOS and 157.0.8103.50 for Linux, rolling out over the coming days and weeks, which means the version check, not the announcement, tells any given machine whether it is covered. An Extended Stable update the same day took that channel to 156.0.8078.96 with 11 fixes including this flaw. The release makes eight actively exploited Chrome zero-days addressed in 2026, after CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491. The other eight fixes are not filler: seven high-severity issues in total, including a second XML use-after-free (CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12), a type confusion flaw in the V8 JavaScript engine (CVE-2026-125344), an out-of-bounds write in the GPU component (CVE-2026-125348), an uninitialized resource in WebGL (CVE-2026-125345), an incorrect authorization flaw in FileSystem (CVE-2026-125347) and a buffer overflow in Compositing (CVE-2026-125343), plus two medium-severity GPU fixes. Hong Kong computer emergency team rated the set extremely high risk on November 10. Users of other Chromium-based browsers, including Microsoft Edge, Brave, Opera and Vivaldi, take the same fixes as their vendors ship them.

Executives

The browser is the most used application in the company and the least owned. Eight exploited Chrome zero-days in one year is the cadence to plan around: the control that matters is not a memo after each release, it is a standing policy that forces the update and the relaunch within a set number of hours, verified by reported version. Ask what share of your fleet is on build 157.0.8103.50 or later today, and treat the honest answer, which will be a percentage and not a yes, as the metric to track until it closes.

CIO / CISO

Push the build and prove the relaunch. A downloaded update does not protect a running session, so pair the deployment with a restart enforcement window and measure by version telemetry, not by package delivery. Inventory the Chromium family, not only Chrome: Edge, Brave, Opera and Vivaldi inherit the flaw and patch on their own schedules, and the unmanaged personal-browser install on a work machine is the copy most likely to lag. Google is withholding exploit details, so detection content is thin by design; the remediation evidence is the fleet version distribution itself.

Engineers

Check the exact builds: 157.0.8103.50 or .51 on Windows and macOS, 157.0.8103.50 on Linux, and 156.0.8078.96 for Extended Stable. Force a browser restart in the management policy and confirm the running process version after it, since long-lived sessions are the normal state on workstations. If your telemetry cannot report browser build per device, this week is the reason to fix that gap: nine flaws, seven rated high, cannot be triaged by hand. Watch for the downstream Chromium updates and apply the same version proof there.

Everyone (non-IT)

This one is yours, and it takes a minute. Open Chrome, go to Help, then About Google Chrome, let it update, and press Relaunch when it offers. A browser that downloaded an update but never restarted is still running the old, exploitable code. Do the same on your home computer and your phone browser apps. There is no link to click in any email about this and no extension to install; anyone offering one is using the headline, not helping with it.