On November 9, 2026, Google released Chrome 157.0.8103.50 for Linux and 157.0.8103.50/.51 for Windows and Mac. The update fixed CVE-2026-125350, a use-after-free in XML. Google said it is aware that an exploit for that flaw exists in the wild. The next day, the U.S. Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog. The federal due date is November 24.
On November 11, Google released a further Stable update, 157.0.8103.78 for Linux and 157.0.8103.78/.79 for Windows and Mac. That build includes 83 security fixes, five of them rated Critical. Google has not marked any of those November 11 fixes as exploited. The job this week is simpler than the version numbers: relaunch Chrome on every PC and confirm it shows 157.0.8103.78 or later. If you manage Chrome centrally, force a relaunch so the update actually takes effect.
What happened
Google’s November 9 Stable channel post lists nine security fixes. CVE-2026-125350 is rated High and is described as a use-after-free in XML. It was reported by Arni Hardarson (Neonix Security) on October 12 and by an anonymous reporter on November 6. At the bottom of the same post, Google wrote: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
CISA added the CVE to the catalog on November 10, in a batch of six, based on evidence of active exploitation. The catalog entry, in version 2026.11.10 of the feed, is due November 24. CISA describes it as a use-after-free in Chromium’s XML component that could allow a remote attacker to execute arbitrary code inside the sandbox through a crafted webpage. It also notes that the flaw could affect other browsers that use Chromium, including Microsoft Edge and Opera. Known ransomware use is listed as unknown. The entry is not marked for forensic triage.
The November 11 Stable post says the update includes 83 security fixes. Five are listed as Critical: CVE-2026-126885, a use-after-free in ServiceWorker; CVE-2026-126895, a use-after-free in CSS; CVE-2026-126879, a use-after-free in Layout; CVE-2026-126846, a use-after-free in Skia; and CVE-2026-126911, a use-after-free in Accessibility. None of the November 11 entries carry a note that they are being exploited.
What to do this week
- Relaunch Chrome on every work PC this week, including laptops that have been left open for days. Chrome often downloads an update in the background, but the new build does not protect the user until the browser is relaunched.
- Confirm the version. In Chrome, open Settings and then About Chrome, or go to
chrome://settings/help. You want 157.0.8103.78 or later. If an update is still downloading, wait for it to finish and relaunch again. - If you manage Chrome centrally, force a relaunch rather than waiting for each person to close the browser. The November 11 build is rolling out over the coming days and weeks, so check again later in the week on any machine that is still behind.
- If your team also uses Microsoft Edge, Opera or another Chromium-based browser, check those products for their own current updates. CISA’s catalog entry notes that the November 9 flaw could affect them as well. A Chrome relaunch does not cover those browsers.
- Federal civilian agencies have until November 24 to address CVE-2026-125350. A private firm is not under the same mandate, but the date is a useful priority signal: get to the current Chrome build this week, not next month.
Sources
- Google Chrome Releases, “Stable Channel Update for Desktop”, November 11, 2026 (157.0.8103.78/.79 for Windows and Mac, 157.0.8103.78 for Linux; “This update includes 83 security fixes”; five Critical CVEs listed: CVE-2026-126885, CVE-2026-126895, CVE-2026-126879, CVE-2026-126846 and CVE-2026-126911; no exploited note on this post)
- Google Chrome Releases, “Stable Channel Update for Desktop”, November 9, 2026 (157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux; nine security fixes; CVE-2026-125350 rated High, use after free in XML, reported by Arni Hardarson of Neonix Security on October 12 and anonymously on November 6; “Google is aware that an exploit for CVE-2026-125350 exists in the wild.”)
- CISA, “CISA Adds Six Known Exploited Vulnerabilities to Catalog”, November 10, 2026 (CVE-2026-125350 included, additions based on evidence of active exploitation)
- CISA Known Exploited Vulnerabilities catalog JSON feed, version 2026.11.10, released November 10, 2026, at 2:03 p.m. Eastern time (CVE-2026-125350 added November 10, due November 24, forensic triage marked No, known ransomware use Unknown; the entry notes the flaw could affect other Chromium browsers including Microsoft Edge and Opera)
Related: An OpenSSH bug lets attackers skip the password on some Linux servers and Security and vulnerabilities, every security briefing, guide and tool in one place.
Follow Circuit & Capital on Bluesky, Facebook and X (@circuitsfit) for new briefings.