Chrome 157 update fixes XML flaw already exploited in the wild

Chrome 157 update fixes XML flaw already exploited in the wild

10 November 2026: Google has fixed CVE-2026-125350, a use-after-free flaw in XML handling that it says has an exploit in the wild, in Chrome 157.0.8103.50 and .51 for Windows and Mac and 157.0.8103.50 for Linux. The update closes nine security bugs in all and is rolling out over days or weeks, so managed fleets should push it instead of waiting for the staged release.

Not yet independently verified. Google confirms an exploit exists but gives no detail of the attacks. We could not read CISA's web pages, and the number was not in the catalogue feed at its 9 November update. We will update this when it can be confirmed, and remove this note.

An anonymous report and a three-day turnaround

"Google is aware that an exploit for CVE-2026-125350 exists in the wild," the release note says. The bug was reported anonymously on 6 November and shipped as a fix on 9 November. As usual when a flaw is being used, Google has published no technical detail and restricts access to the bug report until most users are updated.

A separate use-after-free in the same component, CVE-2026-125346, was reported on 12 October by Arni Hardarson of Neonix Security. The two have adjacent numbers and share a component, but nothing in the note says they are related.

This is the first security update after the Chrome 157 major release, which fixed 213 bugs.

The other eight fixes

Google rates seven of the nine as high and two as medium:

• High: CVE-2026-125350 and CVE-2026-125346, use after free in XML
• High: CVE-2026-125344, type confusion in V8
• High: CVE-2026-125348, out of bounds write in GPU
• High: CVE-2026-125343, buffer overflow in Compositing
• High: CVE-2026-125345, uninitialised resource in WebGL
• High: CVE-2026-125347, incorrect authorisation in FileSystem
• Medium: CVE-2026-125349 and CVE-2026-125342, uninitialised resource in GPU

Getting it across a managed fleet

Chrome downloads an update silently, but it does not take effect until the browser restarts. An administrator looking at policy compliance should check the running version rather than the installed one, and consider a relaunch notification with a short deadline for this release. Other browsers built on Chromium need their own update, and their vendors will ship the fix on their own schedule, so Edge, Brave and Opera deserve a separate check.

Exposure comes through ordinary browsing. The exploit status means a page visited by a user may be enough, so kiosks, shared desktops and servers running headless Chrome for reporting or scraping should be on the list as well as staff laptops. Linux hosts that run a packaged Chromium from a distribution will depend on that distribution's own timing.

Whether the flaw is added to CISA's catalogue of exploited vulnerabilities, with its short federal deadline, is the next date to look for.

Sources

• Chrome Releases: Stable Channel Update for Desktop, 9 November 2026