Google Patches Chrome Zero-Day, Fixes Active XML Flaw

Google patched its eighth actively exploited Chrome zero-day of the year on Monday rolling out emergency desktop updates to fix a high-severity use-after-free vulnerability in the browser’s XML component tracked as CVE-2026-125350.

Emergency Desktop Updates for Windows, macOS, and Linux

The newly released Stable builds arrive as versions 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and version 157.0.8103.50 for Linux, according to Google’s desktop update advisory. Additionally, the company published Extended Stable version 156.0.8078.96 for Windows and macOS to address the same vulnerability.

Google on Monday released updates to patch nine security vulnerabilities. An anonymous security researcher reported the flaw to Google on November 6, 2026. Just three days later, the tech giant acknowledged that the memory-safety issue was actively being targeted in real-world attacks. “Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the company said in its security bulletin, withholding further technical specifics to prevent additional exploitation.

Google said that access to bug details and links may be kept restricted until a majority of users are updated with a fix, and that restrictions will also be retained if the bug exists in a third-party library that other projects similarly depend on but have not yet fixed.

Google also released Chrome 157.0.8103.50 for Android on November 9, noting that the release includes the same security fixes as the matching desktop version and advising Android users to check Google Play for the update. Vivaldi has already released updates for desktop and Android dated November 10.

Technical Breakdown of the XML Use-After-Free Flaw

In this instance, the flaw resides within the browser’s XML component. The high-severity vulnerability carries a CVSS score of 8.8, and the description on CVE.org notes that the use-after-free bug in the XML component of Google Chrome prior to version 157.0.8103.50 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Google Patches Chrome Zero-Day, Fixes Active XML Flaw — Photo: LinkedIn

Such use-after-free flaws generally happen when software tries to reference a memory address that has already been released. Attackers exploiting these security weaknesses can potentially trigger program crashes, corrupt data, or execute arbitrary code. A plausible delivery route for this flaw involves specially crafted web content that triggers the affected XML transformation code.

Broader Security Fixes and the 2026 Zero-Day Tally

Alongside the zero-day fix, the November 9 security release addresses eight additional vulnerabilities across multiple browser components. The company’s patch also remedies an uninitialized resource defect in WebGL, permission authorization errors in FileSystem, a buffer overflow in Compositing, an out-of-bounds write flaw in the GPU subsystem, type confusion within V8, and another XML-related use-after-free vulnerability.

Google Chrome security advisory, High, Actively exploited (KEV), CVE-2026-125350 — Photo: Rescana

Google fixed two medium-severity issues involving uninitialized resources in the GPU component, while overall Google discovered many of the flaws internally, with the rest identified and reported by external security researchers.

This latest emergency patch brings the total number of actively exploited Chrome zero-days fixed during 2026 to eight, matching the total recorded for the entire previous year. Earlier zero-days patched this year include:

CVE-2026-2441 in February
CVE-2026-3909 and CVE-2026-3910 in March
CVE-2026-5281 in April
CVE-2026-11645 in June
CVE-2026-85046 and CVE-2026-87491 in September

Mandatory Federal Deadlines and User Action

Following the disclosure, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on November 10, 2026, setting a mandatory compliance deadline of November 24, 2026, for federal civilian executive branch agencies. Additionally, the Indian Computer Emergency Response Team published Vulnerability Note CIVN-2026-0544 on November 10, 2026, rating it critical and urging users in India to update their browsers.

Google Patches Eighth Chrome Zero-Day Actively Exploited in the Wild — Heimdal®

Because desktop updates roll out gradually over several days and weeks, security researchers advise users to manually force the installation. Malwarebytes recommended navigating to the three-dot menu, selecting Help, opening About Google Chrome, and clicking Relaunch to ensure the updated process replaces the running software. Individuals utilizing alternative Chromium-powered web browsers like Vivaldi, Opera, Brave, and Microsoft Edge should similarly install these security patches as soon as they become accessible.

Worth a look