On Monday 9 November 2026 Google released an emergency update for the Chrome browser. It fixes CVE-2026-125350, and in its release note Google says it is aware that an exploit for the flaw exists in the wild. All an attacker needs is for the user to open a crafted web page.
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November 2026 and gave US federal agencies until 24 November 2026 to patch. It affects company computers running Chrome and, according to the CISA catalogue entry, other browsers built on Chromium as well, for example Microsoft Edge or Opera.
What happened
Chrome is a web browser made by Google and one of the most widely deployed browsers on company computers. The flaw is a use-after-free, meaning the program works with memory it has already released, and it sits in the component that handles XML and XSLT transformations. A crafted page can use it to corrupt the memory of the renderer, the process that parses and draws page content, and run attacker code inside it.
Google rates the flaw as high severity. An anonymous researcher reported it on 6 November 2026 and the fix shipped three days later. Details of the bug stay restricted while users deploy the update. Google has not said who is behind the attacks, who the targets are or how the exploit reaches users, and it has not said whether attackers chain the flaw with a second vulnerability that would let them escape the browser sandbox. The code that runs stays inside the renderer sandbox, so taking over the whole computer still requires another flaw.
The same Chrome release fixes eight further security issues. Confirmed exploitation concerns only CVE-2026-125350.
Does this affect you?
Check your browser version under Help, About Google Chrome, or on the chrome://settings/help page, which also triggers an update check. The fixed versions according to the Google release note:
| Channel | System | Fixed version |
|---|---|---|
| Stable | Windows and macOS | 157.0.8103.50 or 157.0.8103.51 |
| Stable | Linux | 157.0.8103.50 |
| Extended Stable | Windows and macOS | 156.0.8078.96 |
| Chrome for Android | Android | 157.0.8103.50 |
Edge, Opera and other Chromium based browsers share the same code, but each vendor ships its own fix with its own version number. For Edge, check the version on the edge://settings/help page and install the update as soon as Microsoft releases it.
What to do now
- Update Chrome to 157.0.8103.50 or later and restart the browser. Until the browser restarts, the fix does not apply.
- Where you manage browsers centrally, verify that the update actually rolled out to every workstation and enforce a browser restart. Otherwise the most exposed machines are those of people who never close the browser.
- If you cannot update everything at once, start with people who work with sensitive data and routinely open links from the internet and from email.
- Do not forget unmanaged browsers: supplier devices and personal devices that reach company applications.
- Check the other Chromium based browsers in use in your organisation and their versions.
Google has published no indicators of compromise and no description of attacker activity, so public data does not allow you to look back for exploitation. If a workstation shows suspicious behaviour, assess it the usual way from browser, proxy and endpoint protection logs.
Too much to keep track of?
Every month brings more emergency fixes than one person can review alongside their regular work. We help organisations set up vulnerability management so that it is clear who watches which advisories, what gets deployed immediately and what waits for the regular window. A security assessment is a practical starting point, or request an introductory consultation through our contact page.
Sources: Google Chrome Releases, Stable channel update of 9 November 2026 · CISA KEV catalogue, CVE-2026-125350 added on 10 November 2026 · NVD, CVE-2026-125350 record