Chrome Update Fixes Eighth Exploited Zero-Day of 2026

Google patched CVE-2026-125350, a high-severity use-after-free bug in Chrome's XML component, and says an exploit exists in the wild. Update Chrome to 157.0.8103.50 or later and relaunch the browser.

The steps below are quick for one machine. Admins can use the commands to check a whole fleet.

What Google fixed on Monday

Google on Monday released updates for nine security vulnerabilities. One of them is under active exploitation.

The exploited flaw is CVE-2026-125350, rated CVSS 8.8. CVE.org describes it as a use-after-free in XML that "allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page."

A use-after-free happens when a program touches memory after it has been freed. Exploitation can lead to data corruption, crashes, or arbitrary code execution. An anonymous researcher reported the flaw on November 6, 2026.

For a shorter patch summary, see our CVE-2026-125350 guide.

Affected and fixed Chrome versions

Any Chrome build older than 157.0.8103.50 is affected. The fixed builds are below.

How serious this is

This is a confirmed in-the-wild bug, not a theoretical one. Google said it is "aware that an exploit for CVE-2026-125350 exists in the wild."

The CVSS score is 8.8, which is high. The description says code runs inside the sandbox. That is a real boundary, but a browser bug reachable from a web page is still a reason to patch fast.

It is the eighth Chrome zero-day Google has fixed this year. The earlier seven are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491.

CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies must patch by November 24, 2026.

Google has not shared how attackers use the bug yet, so watch the source report for updates.

Google also explained why details are limited: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix."

Update Chrome in five steps

1. Open Chrome and go to More > Help > About Google Chrome.

2. Wait while Chrome downloads the update.

3. Select Relaunch. The fix does not apply until you do.

4. Reopen the About page and confirm the version is 157.0.8103.50 or higher.

5. Update Edge, Brave, Opera, and Vivaldi as soon as their fixes appear.

On Linux, you can also update from the package manager:

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade google-chrome-stable

# RHEL / Fedora
sudo dnf upgrade google-chrome-stable

Commands to check your exposure

Run the command for your platform. Any version lower than 157.0.8103.50 needs the update.

# Linux
google-chrome --version

# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version

On Windows, Chrome can live in three common places. System installs use C:\Program Files\Google\Chrome\Application\chrome.exe. Older installs may use C:\Program Files (x86)\Google\Chrome\Application\chrome.exe. Per-user installs use $env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe.

This loop checks all three paths. It prints a pass or fail for each copy it finds, and True means that copy still needs the patch. A host with no Chrome in these paths prints nothing.

$paths = @(
  "C:\Program Files\Google\Chrome\Application\chrome.exe",
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
  "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    $v = (Get-Item $p).VersionInfo.ProductVersion
    "$env:COMPUTERNAME  $p  $v  NeedsPatch=$([version]$v -lt [version]'157.0.8103.50')"
  }
}

You can also read the version of the last launched profile from the registry:

reg query "HKCU\Software\Google\Chrome\BLBeacon" /v version

Run the loop through your remote management tool to cover many machines. Collect the output per host and search for NeedsPatch=True.

Checklist for admins

• List every machine with Chrome and every Chromium-based browser you allow.

• Push the update, then ask users to relaunch. A downloaded update does not protect open sessions.

• Re-run the version check after the relaunch window, not before.

• Record the CISA KEV date, November 24, 2026, if you report to federal rules.

• Add Edge, Brave, Opera, and Vivaldi to the same tracker and close each one when its fix lands.

What learners can take from this

This bug shows a common pattern: a memory-safety flaw in a browser component, reached through a crafted web page. Practice reading a CVE entry, checking the CVSS score, and matching fixed versions to what you run. Those are everyday skills for help desk, SOC, and vulnerability management roles.

If you are building toward a security exam, our cybersecurity certification page lists the vouchers we sell. Your code is emailed within 12 hours of payment and also shown in your account.

Sources

• Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026