Chrome Patches Exploited XML Zero-Day, Eighth This Year

Update Chrome to 157.0.8103.50 or newer today. Google fixed CVE-2026-125350, a high-severity use-after-free in Chrome's XML component that is already exploited in attacks.

What Google fixed in the Chrome 157 update

Google on Monday told Chrome users about security updates that patch nine vulnerabilities, including the zero-day. The exploited bug is tracked as CVE-2026-125350. An anonymous researcher reported it to Google on November 6.

This is the eighth Chrome zero-day exploited this year. The earlier ones are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491.

The same release fixes six other high-severity bugs. They sit in WebGL, FileSystem, Compositing, GPU, V8 and XML. Google found most of them internally. Two medium-severity uninitialized resource bugs in the GPU component are also fixed.

We keep a separate page on this flaw: CVE-2026-125350 Google Chromium Vulnerability: Patch Now.

Affected and fixed Chrome versions

The patches ship in Chrome 157. Any build older than the versions below should be treated as vulnerable.

How serious CVE-2026-125350 is

Google rates it high severity, and it is exploited in the wild. A use-after-free means the browser keeps using memory after freeing it. Attackers commonly turn that kind of bug into code execution inside the browser process, often chained with other flaws.

CISA had not added it to its Known Exploited Vulnerabilities catalog at the time of the report, so check the CISA KEV catalog for changes.

Use this table to set your priority:

Update Chrome and confirm the version

1. Open chrome://settings/help. Chrome checks for updates and downloads them.

2. Click Relaunch. The fix does not apply until the browser restarts.

3. Reopen chrome://settings/help and confirm the number is 157.0.8103.50 or higher.

You can also check from a terminal.

Windows (PowerShell):

(Get-Item "$env:ProgramFiles/Google/Chrome/Application/chrome.exe").VersionInfo.ProductVersion

macOS:

"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version

Linux (Debian or Ubuntu):

sudo apt update && sudo apt install --only-upgrade google-chrome-stable
google-chrome --version

Worked example: a laptop reports 156.0.7000.10. The major number is below 157, so it is vulnerable. Update it. After the update it should report 157.0.8103.50 or higher. If it still shows an older number, Chrome was not relaunched.

Audit your whole fleet

If you run Microsoft Defender for Endpoint, this advanced hunting query lists Chrome installs below the fixed build:

DeviceTvmSoftwareInventory
| where SoftwareName =~ "chrome"
| extend v = parse_version(SoftwareVersion)
| where v < parse_version("157.0.8103.50")
| project DeviceName, SoftwareVersion

On Debian or Ubuntu servers and desktops, run this over SSH:

dpkg-query -W -f='${Version}\n' google-chrome-stable

Compare each result with 157.0.8103.50. Re-run the audit after the rollout and chase the devices that stay behind. Laptops that are rarely restarted are the usual stragglers.

Other Chromium-based browsers ship their own builds. Check each vendor's release notes before assuming you are covered.

What IT and security learners can take from this

This story shows a real patch-management loop: a vendor advisory, a fixed version number, a verification step and a fleet audit. Learn to read a version string, write a query that finds old builds, and prove the fix landed. Those skills sit at the heart of vulnerability management and show up in advanced security exams such as CompTIA SecurityX (CAS-005). Practice the audit steps above in a lab before you need them at work.

Browsing our cybersecurity certification page can help you plan your next exam.

Sources

• Chrome Update Patches Exploited XML Zero-Day, Eighth This Year (SecurityWeek)