🔍 Read the full analysis: How Chrome’s XML Bug Became Its Eighth Zero-Day Of 2026 on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Google released Chrome security updates on November 9, 2026, including a fix for CVE-2026-125350, a high-severity XML use-after-free bug that Google says is being exploited in the wild. The flaw is the eighth Chrome vulnerability Google has flagged as exploited this year. Google has not disclosed who is behind the attacks, who was targeted or how the exploit works.
Google released Chrome security updates on November 9 that fix CVE-2026-125350, a high-severity use-after-free bug in the browser’s XML component. Google says it is aware of an exploit for the flaw being used in the wild, making it the eighth Chrome vulnerability flagged as exploited in 2026 and prompting users to update to a patched version.
Google’s release notes describe the defect as “Use after free in XML” and rate it high severity. The company’s statement that an exploit exists in the wild confirms that attackers have used or are using exploit code, but Google has not published details of the attacks or their targets. The vulnerability was reported by an anonymous researcher on November 6, three days before the patch was released.
Google lists Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Extended Stable users on Windows and Mac should use 156.0.8078.96. The desktop update is rolling out over the coming days or weeks, while the Android version is due through Google Play over the next few days, according to Google. A downloaded desktop update takes effect after Chrome is relaunched.
The release includes eight other security fixes. One addresses a separate XML use-after-free issue, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12. Google’s notes do not say that the second flaw has been exploited. The confirmed in-the-wild notice applies to CVE-2026-125350.
Chrome’s XML Bug Becomes 2026’s Eighth Zero-Day
Google says CVE-2026-125350 is being exploited in the wild. A patch is available, but users need to relaunch Chrome to apply it.
What Google confirmed
The XML use-after-free bug is rated high severity. Google has not described the exploit’s mechanics or its impact.
Exploitation in the wild
Google says an exploit exists, but has not identified attackers or targets.
Attack details
The scale, circumstances, and effects of these attacks have not been disclosed.
Check your browser
Chrome’s rollout may take days or weeks on desktop and a few days on Android.
On desktop, open Help, then About Google Chrome. Android users can check Google Play.
Chrome lists version 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux and Android. Extended Stable on Windows and Mac: 156.0.8078.96.
A downloaded desktop update takes effect after the browser is relaunched.
Chromium browsers need their own updates
A Chrome patch does not automatically update other browsers built on Chromium.
| Browser | Status reported Nov 10 |
|---|---|
| Vivaldi | Desktop update included a fix |
| Brave | Listed release used patched Chromium |
| Microsoft Edge | Fix in progress |
| Opera | No desktop announcement found |
What the eighth count means
The count comes from Google release notices that reported exploitation in the wild. It is not a complete tally of browser attacks or vulnerabilities.
- Google says CVE-2026-125350 is exploited in the wild.
- An anonymous researcher reported the flaw on November 6.
- Who is behind the attacks or who was targeted.
- How the exploit works or what impact it had.
Why the XML Flaw Needs a Patch
The security notice matters because the affected browser has a fix available while exploitation has already been reported. Users who remain on an unpatched version may continue using software that Google says is vulnerable to an exploit in circulation. Updating and restarting Chrome applies the fix; simply downloading it may not.
The defect is a memory-management error. In a use-after-free bug, software attempts to use a block of memory after it has released it. Depending on the circumstances, this class of flaw can cause a crash, corrupt data or potentially allow code execution, as The Hacker News reported. Those are possible outcomes associated with the bug type, not confirmed effects of this particular exploit. Google has not explained what an attacker can accomplish through CVE-2026-125350.
The patch also matters beyond Chrome itself. Other browsers built on Chromium need their own vendors to incorporate and ship the relevant fixes. A Chrome update does not automatically update every Chromium-based browser; users should check the release information for the browser they actually use.
Products Worth Considering
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
As an affiliate, we earn on qualifying purchases.
How Chrome Reached Eight
The figure of eight exploited Chrome flaws in 2026 comes from a count of Google Chrome Releases posts that say the company is aware of exploitation in the wild. The seven earlier entries listed in the source material are CVE-2026-2441 in February; CVE-2026-3910, CVE-2026-3909 and CVE-2026-5281 in March; CVE-2026-11645 in June; and CVE-2026-85046 and CVE-2026-87491 in September. The count describes Google’s public notices, not a complete tally of all attacks or vulnerabilities affecting browsers.
Google has not identified the XML component or the specific browser activity that triggers the flaw. XML is used in several browser-related formats, including SVG graphics and XML documents, but the available release note does not say which use is affected. The count and the three-day report-to-patch timeline are based on Google’s release information; the source article says SecurityWeek, The Hacker News and BleepingComputer reported the same count.
As of November 10, the source material also reported updates from other Chromium-browser vendors. Vivaldi said its desktop update included a fix, and Brave’s listed release was built on the patched Chromium version. Microsoft said it was working on an Edge fix but had not listed a fixed version. The source found no Opera desktop announcement about the flaw at that time. These are time-specific vendor statuses, not guarantees about current versions.
““Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.””
— Microsoft, Edge security release notes, November 9
Attack Details Remain Restricted
Google has not disclosed who is behind the exploitation, who has been targeted or how the exploit works. Its public notice confirms in-the-wild exploitation but provides no information about the number of attacks, their duration or their impact. The available reporting does not establish whether the vulnerability was used in targeted attacks or more broadly.
Google has also not specified which part of its XML handling is vulnerable or what conditions are needed to trigger the flaw. Potential consequences of use-after-free bugs should not be treated as confirmed outcomes in this case. The source material did not identify a Google release note for Chrome on iOS or ChromeOS that mentioned CVE-2026-125350 as of November 10, and vendor release timing for other Chromium-based browsers can change.
Check for the Fixed Browser Version
Chrome users can open the three-dot menu, select Help, then About Google Chrome to check their version and prompt an update. On desktop, relaunch the browser after the update downloads so the patched version is active. Android users can check Google Play for a Chrome update and confirm the installed version under Chrome’s settings.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should check that browser maker’s own release notes and update channel. As of the source report’s November 10 check, vendor rollout status differed: Vivaldi had announced a fix, Brave listed a release based on patched Chromium, and Microsoft said an Edge fix was in progress. Further vendor updates and Google’s continuing rollout will clarify which versions are patched across platforms.
Key Questions
What is CVE-2026-125350?
It is a high-severity use-after-free vulnerability in Chrome’s XML component. Google says an exploit for it exists in the wild, but has not described the exploit’s mechanics.
Why is it called Chrome’s eighth zero-day of 2026?
The source report counted eight 2026 Chrome release notices in which Google said it was aware of exploitation in the wild. The number refers to those public notices, not to every Chrome vulnerability or attack that may have occurred.
Which Chrome versions contain the fix?
Google lists versions 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and Android, and 156.0.8078.96 for Extended Stable on Windows and Mac. Check Chrome’s About page because availability depends on the rollout.
Does updating Chrome protect other Chromium browsers?
No. Chromium-based browsers depend on their own vendors to ship updates. Check the release notes and update status for the browser installed on your device rather than assuming Chrome’s patch has reached it.
What is still unknown about the attacks?
Google has not publicly identified the attackers, targets, exploit method or impact. Its notice confirms exploitation in the wild, but the available information does not establish the scale or circumstances of the attacks.
Source: ThorstenMeyerAI.com
