Google patched an exploited Chrome zero-day, the eighth this year. Here is the fixed version, how to update and what is still unknown.
As of Tuesday, Nov. 10, 2026, Google Chrome has a new emergency fix to install. Google's Stable channel update on Monday, Nov. 9, patches nine security bugs, and one of them, CVE-2026-125350, is already being used in attacks. It is the eighth Chrome zero-day Google has fixed this year, according to BleepingComputer and The Hacker News.
If your browser has been open for days, the patch may be sitting there waiting for a restart. Here is what Google confirmed, how to check your version, and what is still unknown.
Which Chrome version fixes the zero-day?
Chrome 157.0.8103.50 or .51 on Windows and Mac, and 157.0.8103.50 on Linux. Google's Chrome Releases blog says the build will roll out "over the coming days/weeks," so not everyone will see it at once. BleepingComputer reported that the update was available as soon as it checked on Tuesday morning.
Chrome for Android also moved to 157.0.8103.50 on Nov. 9 and will reach Google Play over the next few days. Google says Android builds carry the same security fixes as the matching desktop release unless it notes otherwise.
What is CVE-2026-125350?
It is a high-severity use-after-free bug in Chrome's XML component. In plain terms, the browser keeps using a piece of memory after it has been released, and an attacker can sometimes steer that mistake into running their own code. The Hacker News notes that such bugs can lead to crashes, corrupted data or arbitrary code execution.
Google's advisory is short: it is "aware that an exploit for CVE-2026-125350 exists in the wild." An anonymous researcher reported the flaw on Nov. 6, so the fix landed three days later. That is quick, and it is also a reminder that attackers had a head start of unknown length.
A second XML use-after-free, CVE-2026-125346, is in the same release. Google credits Arni Hardarson of Neonix Security for finding it on Oct. 12, and Google does not list it as exploited. Seven of the nine fixes are rated high and two medium.
How do you update Chrome right now?
Open Chrome, click the three-dot menu, then go to Help and About Google Chrome. The page checks for an update on its own. When it finishes, click Relaunch. Chrome restores your open tabs, though Incognito windows will not come back, according to Google's own help page.
On a Mac, the About page also offers an option to update Chrome automatically for every user on the computer. On Linux, Google says to update through your package manager. On a Chromebook, Chrome updates with the operating system.
If you see no Relaunch button, you are already on the newest version. Compare the number under the Google Chrome heading with 157.0.8103.50.
Other Chromium-based browsers, including Microsoft Edge, Brave, Opera and Vivaldi, use the same engine. The Hacker News advises their users to install fixes as each vendor ships them. Google's advisory covers Chrome only, so check each browser's own update page for its patched build.
What is confirmed and what is not?
- Confirmed by Google: an exploit for CVE-2026-125350 exists in the wild, and the fix is in Chrome 157.0.8103.50/.51.
- Confirmed by Google: the update contains nine security fixes, seven high and two medium.
- Reported by The Hacker News and BleepingComputer: this is the eighth exploited Chrome zero-day of 2026.
- Not disclosed: who is behind the attacks, who was targeted, and how many people were affected.
- Not available yet: bug details. Google says it may keep them restricted until most users have updated.
Our take
Eight exploited zero-days in the first ten months of the year is a lot, and it changes how casual users should treat the Relaunch button. The old habit of leaving a browser open for a week with forty tabs is the real risk here. Our view: restart Chrome today, then restart it every time the little update arrow turns green or orange in the corner.
Google is also being tight-lipped, which is normal, but it leaves ordinary users guessing. With no word on targets, assume the worst case and patch. The cost is a thirty-second restart.
Related reading
Picture credit: Google
