Google has released an emergency Chrome update for Windows, Mac, Linux and Android that fixes a security flaw attackers are already exploiting. The vulnerability, tracked as CVE-2026-125350, is a high-severity use-after-free bug in Chrome's XML component, and Google says it is aware that an exploit for it exists in the wild.
The fix shipped on November 9 in Chrome 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux and 157.0.8103.50 for Android, as Malwarebytes' write-up of the release sets out. The update contains nine security fixes in total. It follows the Chrome 157 release earlier this month that patched more than 200 bugs.
Very little is known about the attacks
According to Google, an unnamed third party reported the flaw on November 6, three days before the patch. Google has not said who is exploiting it, who has been targeted, how the exploit is delivered or what it achieves on a victim's machine.
A use-after-free bug happens when a program keeps using a piece of memory after it has been released. Depending on the circumstances that can crash the program or, in some cases, let an attacker run their own code. The XML component handles a structured data format that Chrome reads as part of certain web content. Hong Kong's computer emergency response team, HKCERT, rates the overall risk of the update as "Extremely High", noting that the fixes cover issues that could allow denial of service, security restriction bypass and remote code execution.
Update to Chrome 157.0.8103.50 or later
Chrome updates itself automatically, but the rollout reaches users over days and weeks, and a browser that is never closed may not apply it. To update now:
- On desktop, open About Google Chrome from the Settings or Help menu. Chrome will check for and download any available update. If prompted, click Relaunch to apply it.
- Confirm the version reads 157.0.8103.50 or later (157.0.8103.51 on some Windows and Mac installs).
- On Android, update Chrome from Google Play. Google says the Android build carries the same security fixes as desktop unless otherwise noted.
This is not the first Chrome flaw exploited in the wild this year, following the V8 zero-day patched in June. With an exploit already circulating and no detail on who is using it, the only defense on offer is the patch itself, and a browser that has downloaded it but never restarted is still exposed.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.