> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Update Chrome now: Google patches an XML zero-day exploited in attacks
- URL: https://www.skimwire.com/chrome-zero-day-xml-update-157/
- Published: 2026-11-10T13:34:00.000Z
- Updated: 2026-11-10T13:34:00.000Z
- Description: Google says an exploit for Chrome flaw CVE-2026-125350 exists in the wild. The fixed versions, who needs them and how to update now.
- Author: Iris Kade
- Tags: Security, Apps

## The skim

- **Exploited now:** Google says it's aware an exploit exists in the wild for CVE-2026-125350, a high-severity use-after-free bug in Chrome's XML component.
- **The fix:** Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, released Monday, Nov. 9, with nine security fixes in total.
- **What to do:** open Chrome's menu, go to Help > About Google Chrome, let it check, then select Relaunch.

## What happened

Google pushed a Chrome Stable update on Monday that patches nine security flaws. One of them is already being used in attacks. In its release notes, Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." The flaw is a use-after-free in XML, and Google rates it High. An anonymous researcher reported it on Nov. 6, so the fix arrived three days later.

Google hasn't said who is exploiting the bug, who is being targeted or how the attacks are delivered. As usual, it's holding back bug details "until a majority of users are updated with a fix." [BleepingComputer](https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/?ref=skimwire.com) and [SecurityWeek](https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/?ref=skimwire.com) both count it as the eighth Chrome zero-day exploited this year.

The other eight fixes: six more High-severity bugs (in WebGL, FileSystem, Compositing, GPU, V8 and a second XML flaw) and two Medium GPU issues. Google says none of those are known to be exploited.

## Which version you need

- **Windows and Mac:** 157.0.8103.50 or .51, or later.
- **Linux:** 157.0.8103.50 or later. Linux users update through their package manager.
- **Android:** Google released Chrome 157.0.8103.50 for Android the same day. It's rolling out on Google Play "over the next few days," and Google says Android builds carry the same security fixes as the matching desktop release unless it notes otherwise.
- **Extended Stable** (mostly managed business PCs): 156.0.8078.96, which Google lists with the same exploited CVE among its 11 fixes.

Google says the desktop update "will roll out over the coming days/weeks," so yours may not have arrived on its own yet. When BleepingComputer checked manually on Monday, the update was already available.

## How to update now

On a computer, open Chrome and select the three-dot **More** menu, then **Help > About Google Chrome**. Chrome checks for updates on that page. If you see **Relaunch**, select it. Chrome reopens your regular tabs and windows, but not Incognito ones. A downloaded update doesn't protect you until the browser restarts, so don't leave it waiting for days. On Android, open the Play Store, tap your profile icon, go to **Manage apps & device**, and update Chrome if it's listed.

Our step-by-step guide covers every platform, including Chromebooks and what to do if the update won't install: [How to update Google Chrome on your computer, Android phone or iPhone](https://www.skimwire.com/how-to-update-google-chrome-computer-android/).

## Why it matters

Browsers are the main way attackers reach ordinary people, and an exploited Chrome bug is about as urgent as routine updates get. Chrome-based browsers like Microsoft Edge, Brave and Opera share much of Chrome's code, so watch for their updates this week too. We haven't confirmed which builds of those browsers include this fix. If your Android phone or iPhone is also behind on updates, our [earlier coverage of Chrome and phone attacks](https://www.skimwire.com/poisoned-source-iphone-android-chrome-attacks-update/) explains why staying current matters.

*Sources:* [*Google Chrome Releases: Stable Channel Update for Desktop (Nov. 9, 2026)*](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop%5F018223192.html?ref=skimwire.com)*;* [*Chrome Releases: Chrome for Android Update and Extended Stable Update (Nov. 9, 2026)*](https://chromereleases.googleblog.com/?ref=skimwire.com)*;* [*Google Chrome Help: Update Google Chrome*](https://support.google.com/chrome/answer/95414?ref=skimwire.com)*;* [*BleepingComputer*](https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/?ref=skimwire.com)*;* [*SecurityWeek*](https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/?ref=skimwire.com)*.*