Google published a Stable channel update for desktop Chrome on 9 November 2026 that addresses CVE-2026-125350, a use-after-free in Chrome's XML component. Google rates CVE-2026-125350 High and states, verbatim: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." That is the vendor's wording. This advisory does not add victim counts, campaign names, or a description of how the exploit is used.
The official Stable builds are 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. A same-day official Chrome for Android post ships 157.0.8103.50 and states that Android releases contain the same security fixes as the corresponding Desktop releases unless otherwise noted; that post notes no exception. Extended Stable customers should apply the separate official 9 November update, which moves Windows and Mac to 156.0.8078.96 and lists CVE-2026-125350 among its High fixes. Google says the desktop updates "will roll out over the coming days/weeks," so a 9 November release date is not proof that every endpoint is already patched. Confirm the installed version and relaunch.
HKCERT's 10 November 2026 bulletin on the same Stable-channel fixes is rated Extremely High Risk and says CVE-2026-125350 "is being exploited in the wild." That risk label is HKCERT's; prefer Google's High severity for CVE-2026-125350 and Google's in-the-wild sentence as the primary record. As of this review (10 November 2026, 08:38 Asia/Jerusalem UTC+2), CVE-2026-125350 has no published cve.org record (the CVE Program API returned CVE_RECORD_DNE) and the NVD API returned zero results, so there is no NVD or CNA CVSS score to cite. CVE-2026-125350 is not in the CISA Known Exploited Vulnerabilities catalog (catalogVersion 2026.11.09, dateReleased 2026-11-09T19:54:37.4945Z, checked 10 November 2026 at 08:38 Asia/Jerusalem UTC+2). Google's awareness of an in-the-wild exploit is still a reason to patch and relaunch now.
Technical Information
Google's 9 November 2026 Stable Channel Update for Desktop lists nine security fixes: seven High and two Medium. CVE-2026-125350 is titled High: Use after free in XML and was reported by anonymous on 2026-11-06. The same update includes a second High use-after-free in XML, CVE-2026-125346, reported by Arni Hardarson (Neonix Security) on 2026-10-12. Only CVE-2026-125350 is the identifier Google names in the in-the-wild exploit sentence. Do not treat those two identifiers as the same bug.
Google has not published a technical write-up, exploit method, or indicators for CVE-2026-125350. The Stable-channel post notes that access to bug details and links may be kept restricted until a majority of users are updated with a fix. This advisory does not reconstruct exploit steps or payloads.
Official Google posts reviewed for this draft do not assign a fix for CVE-2026-125350 to ChromeOS or ChromeOS Flex. The latest official ChromeOS / ChromeOS Flex Stable post reviewed here is dated 6 November 2026 (browser 156.0.8078.93) and does not list this CVE; track Chromebook fleets against a later official ChromeOS advisory. Chromium-based browsers should check their vendor; the official Google posts and the HKCERT bulletin do not state their patch status, and this advisory does not claim versions or fix dates for them.
Affected Product Versions
| Product | Official fixed version (Google, 9 November 2026) | Notes |
|---|---|---|
| Google Chrome, Windows and Mac (Stable) | 157.0.8103.50/.51 | Desktop Stable post; rollout "over the coming days/weeks" |
| Google Chrome, Linux (Stable) | 157.0.8103.50 | Same desktop post |
| Google Chrome for Android | 157.0.8103.50 | Separate Android post; same security fixes as desktop unless otherwise noted (no exception noted) |
| Google Chrome, Windows and Mac (Extended Stable) | 156.0.8078.96 | Separate Extended Stable post; lists CVE-2026-125350. Earlier 156.0.8078.88 (3 November 2026) does not list this CVE |
| Google ChromeOS / ChromeOS Flex | Not confirmed in sources reviewed | 6 November 2026 ChromeOS Stable post (browser 156.0.8078.93) does not list CVE-2026-125350 |
Confirm the exact installed version rather than a major-version label such as "Chrome 157" or "Chrome 156." Treat earlier builds below the fixed versions as unpatched for this identifier.
Workaround and Mitigation
The fix is the official Google update. On every managed and unmanaged Chrome install, update to the fixed build for that channel and platform, then relaunch Chrome so the new binary is actually running. An update left in a long-running browser process is not a completed fix.
For enterprise estates, enforce the official update and a timely relaunch through your Chrome or endpoint management tools, and record the installed version after the change. Do not rely on optional user-prompted updates alone. Lift any pin that keeps a kiosk or third-party image on an older build. Extended Stable customers should move to 156.0.8078.96, not remain on 156.0.8078.88. Chromium-based browsers should check their vendor; this advisory does not claim a version or patch date for those products. No official workaround appears in the Google posts reviewed, and there is no basis to invent one.
Indicators of Compromise
Google has not published IP addresses, domains, file hashes, or detection signatures for CVE-2026-125350 in the official materials reviewed for this draft. Bug details may remain restricted until a majority of users are updated. There is no basis to invent indicators. Unexpected new browser processes, extensions, or outbound connections are general investigative leads only, not definitive evidence of CVE-2026-125350.
What to Ask Your Suppliers Today
Ask any supplier, managed service provider, or workplace that runs browsers for you — including VDI, contractor laptops, kiosks, and customer-facing support tools:
- Do you run Google Chrome, and on which channel? Identify Stable, Extended Stable, Android, and any ChromeOS deployments in scope, including images you do not patch yourselves.
- Are you on a fixed build? Request the exact installed version — 157.0.8103.50/.51 (Windows and Mac Stable), 157.0.8103.50 (Linux or Android), or 156.0.8078.96 (Windows and Mac Extended Stable) — not a generic "Chrome is up to date" or "we are on Chrome 157."
- If not, what is your patch and relaunch date? Require a named owner, a target date, and evidence that browsers were relaunched after the update, including any pinned or air-gapped images.
- Have you checked other Chromium-based browsers with their vendor? Ask who owns that follow-up. This advisory does not claim a version or patch date for those products.
Track incomplete answers to closure. The supplier questions are qualitative TPRM follow-ups; they are not an internet-scale prevalence claim.
Need help identifying which suppliers still run unpatched Chrome for CVE-2026-125350, and tracking their official update and relaunch plans? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- Google: Stable Channel Update for Desktop, 9 November 2026 — 157.0.8103.50/.51 (Windows and Mac), 157.0.8103.50 (Linux); nine security fixes; High CVE-2026-125350 Use after free in XML, reported by anonymous on 2026-11-06; "Google is aware that an exploit for CVE-2026-125350 exists in the wild."
- Google: Extended Stable Update for Desktop, 9 November 2026 — 156.0.8078.96 for Windows and Mac; lists High CVE-2026-125350. Does not repeat the in-the-wild sentence.
- Google: Chrome for Android Update, 9 November 2026 — 157.0.8103.50; same security fixes as the corresponding Desktop releases unless otherwise noted.
- Google: Stable Channel Update for ChromeOS / ChromeOS Flex, 6 November 2026 — browser 156.0.8078.93; CVE list does not include CVE-2026-125350.
- HKCERT: Google Chrome Multiple Vulnerabilities, 10 November 2026 — Extremely High Risk; "CVE-2026-125350 is being exploited in the wild."
- CVE.org record page for CVE-2026-125350 — checked 10 November 2026 at 08:38 Asia/Jerusalem UTC+2; the CVE Program API at cveawg.mitre.org returned CVE_RECORD_DNE (no published record, no CNA CVSS).
- NVD CVE-2026-125350 — NVD API 2.0 returned totalResults 0 at the same check (timestamp 2026-11-10T06:38:53.085Z).
- CISA vulnerability catalog JSON feed — catalogVersion 2026.11.09, dateReleased 2026-11-09T19:54:37.4945Z, checked 10 November 2026 at 08:38 Asia/Jerusalem UTC+2; CVE-2026-125350 is not listed.
