Security

Chrome zero-day CVE-2026-125350 is under attack, and Google has a fix

Google released a Chrome update on Monday, November 9, that patches a zero-day flaw, CVE-2026-125350, which the company says attackers are already exploiting. The fix arrives automatically, but Chrome only applies it after a restart, so anyone who keeps the browser open for days is still exposed.

By Techieslite ·

Techieslite graphic with the Google Chrome logo and the headline "Update Chrome now: zero-day under attack"

Which versions fix the Chrome zero-day

The patched builds are Chrome 157.0.8103.50 or .51 on Windows and Mac and 157.0.8103.50 on Linux. Google says the update will roll out "over the coming days/weeks."

Chrome's Extended Stable channel gets the same fix in version 156.0.8078.96 for Windows and Mac. Google released Chrome 157.0.8103.50 for Android the same day, and it will reach Google Play over the next few days. Google says Android releases carry the same security fixes as the matching desktop release unless it notes otherwise.

What Google says about the flaw

CVE-2026-125350 is a high-severity use-after-free bug in Chrome's XML component. An anonymous researcher reported it to Google on Friday, November 6. In its release notes, Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild."

Google hasn't said who is using the exploit, who the targets are or how the attacks work. Google says bug details may stay restricted until most users have the fix.

The other 8 fixes

The update fixes 9 security flaws in total. The other 6 high-severity bugs affect WebGL, FileSystem, Compositing, GPU, the V8 JavaScript engine and a second XML flaw. 2 medium-severity bugs, both in GPU, round out the list. Google found 6 of the 9 issues itself, and outside researchers reported the other 3.

How to install the update

Chrome downloads updates in the background and installs them when you close and reopen it. To get the fix now:

  1. Open Chrome and select the More menu at the top right.
  2. Choose Help, then About Google Chrome. Chrome checks for updates on this page.
  3. Select Relaunch. Chrome reopens your tabs and windows, but Incognito windows won't come back.

If you don't see a Relaunch button, you already have the newest version available to you. Because the rollout is staged, it can take a while to reach every computer, so check again later if the button doesn't appear. On Linux, Google says to update Chrome through your package manager. On a Chromebook, Chrome updates along with ChromeOS.

What it means for you

Restart Chrome today. Google has confirmed the flaw is being used in real attacks.

Whether a computer can get the fix depends on its operating system. Google's requirements for current Chrome versions are Windows 10 or later on Intel-based PCs, Windows 11 or later on ARM-based PCs and macOS 13 Ventura or later on a Mac. A PC still on Windows 7 or 8.1, or a Mac stuck on an older macOS release, will keep running an unpatched browser. If you're on Windows 7 or 8.1, our guide to the best browser for a low-end PC covers Firefox 115 ESR, the main browser still getting security updates there. ChromeOS Flex can give an older machine a supported system with a current version of Chrome.

Sources