Google Chrome CVE-2026-125350

Google Chrome stable 157.0.8103.50, released on November 9, 2026, fixes CVE-2026-125350, a use-after-free vulnerability in XML processing. Google states it is aware that an exploit for this vulnerability exists in the wild, and on November 10 it was also added to the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog. On any machine running Chrome, check the version and finish by restarting the browser.

This article is based on Chrome Releases, NVD, CISA KEV and the Microsoft Edge security release notes as of November 11, 2026. Where something could not be confirmed, we wrote "not stated officially" or "not published at the time of writing" rather than filling the gap with guesses. Other vulnerabilities from the same day are in the November 11 vulnerability digest.

- What happened: Chrome has a use-after-free vulnerability in XML processing (CVE-2026-125350, severity High), and exploitation has been confirmed. Opening a crafted web page may allow arbitrary code execution inside the browser. The CVSS 3.1 score is 8.8 (rated by Chrome as the CNA). It was added to CISA KEV on November 10, with a deadline of November 24 for U.S. federal agencies.
- Who is affected: Chrome for desktop (Windows, Mac and Linux) before 157.0.8103.50. Microsoft Edge and other Chromium-based browsers may also be affected until each vendor ships its fix.
- What to do today: (1) update Chrome to 157.0.8103.50 or later, (2) restart the browser (an update alone does not replace the running process), (3) for company devices, check update status in bulk through your admin console or deployment tool, and (4) for Edge and other Chromium-based browsers, check each vendor's release notes.

According to the official Chrome release information, the fix shipped in the 157.0.8103.50 line of stable. It rolls out gradually, so it may not have reached your Chrome yet. If so, check for updates manually.

NVD lists the affected range as Chrome before 157.0.8103.50. The .50 and .51 for Windows and Mac in the table above are per-platform version numbers as written in Chrome Releases; either counts as a fixed version.

A use-after-free is a bug in which a program keeps using memory after it has been released. In Chrome's case, it was in the part of the browser that processes XML. Chrome Releases describes it as "Use after free in XML," with High severity, reported by an anonymous researcher on November 6, 2026.

The CVSS 3.1 score listed on NVD by Chrome as the CNA is 8.8, with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Read plainly, it can be attacked over the network, without special privileges and with low complexity, requires user interaction such as opening a page (UI:R), and can have a large impact on confidentiality, integrity and availability. In other words, opening a crafted web page may allow arbitrary code to run inside the browser.

Google has not published the details of the attack technique. Chrome Releases notes that access to bug details may be restricted until most users have updated. This article likewise does not go into technical detail that the vendor has not made public.

The same stable release, 157.0.8103.50, contains nine security fixes in total. Chrome Releases also lists another XML use-after-free, CVE-2026-125346 (High), and a V8 type confusion, CVE-2026-125344 (High). At the time of writing, only CVE-2026-125350 is stated to have an exploit in the wild. Either way, updating to 157.0.8103.50 or later fixes all of them in the same update.

The wording in Chrome Releases is "Google is aware that an exploit for CVE-2026-125350 exists in the wild." CISA then added this vulnerability (Google Chromium) to the KEV catalog on November 10, with a deadline of November 24 for U.S. federal agencies. The KEV catalog lists only vulnerabilities for which exploitation has been confirmed. The deadline binds U.S. federal agencies; private companies in Japan have no legal obligation. Still, it is a reliable signal that the flaw is being exploited, so the priority is high.

On the other hand, which campaign is behind it, who is exploiting it and at what scale is not stated officially. Keep your distance from alarmist information and unverified "test code" of unknown origin; the most reliable response is simply to finish the update.

The easiest check is from Chrome's own screen. Open the menu at the top right (three vertical dots), then Help, then About Google Chrome (or type chrome://settings/help in the address bar). If the displayed version is 157.0.8103.50 or later, the update is applied. If it is not applied yet, the download starts automatically when you open this page. When it finishes, click Relaunch. Without a restart, the old process keeps running.

To check from the command line, use the commands below. All of them only display a version, on a machine you manage. In Windows PowerShell, for the default install location:

On a Mac, run this in Terminal.

On Linux, run this.

Check whether the value is 157.0.8103.50 or later. The path differs if Chrome is installed per user or in a non-default location. Also, these commands show the installed version, while a browser that has been left running may still be on an old one. After updating, always restart and confirm on the About Google Chrome screen as well.

Open About Google Chrome, update, and restart. If your settings let Chrome keep running in the background after you close it, also quit Chrome from the system tray. Check the version again when done.

Update from About Google Chrome in the Chrome menu, then relaunch. On a Mac, closing the window often does not quit the app. Right-click the Dock icon and choose Quit, or press Command+Q to quit completely, then open it again.

If you installed from the official package repository, update with your package manager. On Debian and Ubuntu:

On Fedora and RHEL:

After updating, quit the running Chrome, start it again, and confirm with google-chrome --version that it is 157.0.8103.50 or later.

With many devices, do not rely on checking one by one; get the update status from the management side. If you use Google Admin console or Chrome Enterprise policies, you can set the policies that prompt a relaunch (RelaunchNotification and RelaunchNotificationPeriod) to reduce the number of devices left unrestarted for long periods after an update. On Windows, use Intune or Group Policy (GPO); on Mac, the deployment features of your MDM, to push Chrome updates and have devices report their version.

It also helps to list, in your asset management tool, the devices with Chrome below 157.0.8103.50 and to contact the owners of un-updated devices individually. Devices that connect to the network rarely, such as those used on business trips or at home, tend to lag. For update operations in general, see the patch and update management guide for small and mid-sized businesses.

Edge is built on Chromium and may be affected by the same vulnerability. The Microsoft Edge security release notes stated on November 9 that Microsoft is aware of the exploits in the wild and is working on releasing a security fix. The most recent stable release listed on that page is 157.0.4341.42 from November 5, but that entry names no CVE and does not indicate whether this fix is included. At the time of writing, a fixed version for CVE-2026-125350 has not been published. Check the Edge release notes and update promptly once a fixed version appears.

Chromium-based browsers such as Brave, Vivaldi and Opera, and Electron-based desktop apps (chat, meetings, developer tools and so on), may carry the same problem until each vendor ships a version that picks up the Chromium update. Check each vendor's official release notes for which Chromium version they now track. We did not verify the fixed versions of these products, so we do not list version numbers here.

The Chrome Releases entry in question (Stable Channel Update for Desktop) covers the desktop update. We have not verified fixed versions for the Android and iOS mobile versions, so this article does not give version numbers. On mobile, check the app store for an update and apply it if one is available.

Below are interim measures for cases where you cannot update right away (waiting for testing, work that cannot be interrupted for a restart, devices on which updates are paused). None of them is a root fix; they only buy time until you can update.

- Do not open URLs of unknown origin (email, chat, SMS, ads), and do not browse sites not needed for work
- Until updated, do not open important admin, accounting or authentication screens in an un-updated browser
- On un-updated devices, avoid using privileged (administrator) accounts and use a standard user
- Reduce connections to dangerous sites with web filtering or a secure DNS service
- If any policy is temporarily holding back updates, lift it and set a short relaunch deadline
- If a device is hard to update, consider using another browser (but note that Chromium-based ones may be affected in the same way)

Mitigations are only a stopgap. Since exploitation has been confirmed, finishing the update and restart quickly is the top priority.

Only three days passed from the report to the release of the fix. Because the fix rolls out gradually, do not assume automatic updates have already done the job; check on the machine in front of you.

- Open About Google Chrome in your own browser and confirm the version is 157.0.8103.50 or later
- If an update is available, apply it and restart the browser completely
- For company devices, list those below 157.0.8103.50 using your admin console or asset management tool
- Contact the owners of un-updated devices and have them finish through the restart
- Set the relaunch prompt policies (RelaunchNotification and RelaunchNotificationPeriod)
- For Edge, check the release notes for a fixed version and update once it is out
- For Brave, Vivaldi, Opera and Electron apps, check each vendor's update information
- Until updates are done, tell staff not to open links of unknown origin
- If you are reviewing how to avoid missed updates, see the patch and update management guide for small and mid-sized businesses

- Vulnerability digest for November 11, 2026
- Patch and update management guide for small and mid-sized businesses
- Vulnerability assessment cost guide

- Chrome Releases, "Stable Channel Update for Desktop" (2026-11-09): https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
- NVD CVE-2026-125350 (CVSS 3.1 8.8): https://nvd.nist.gov/vuln/detail/CVE-2026-125350
- CISA Known Exploited Vulnerabilities Catalog (added 2026-11-10, due 2026-11-24): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Microsoft Edge security release notes: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security