Google has released a Chrome update that fixes CVE-2026-125350, a use-after-free flaw in the browser’s XML processing component that the company says is being exploited in the wild. The fix shipped on Monday, November 9, three days after an anonymous researcher reported the bug.
CVE-2026-125350 Use-After-Free in Chrome XML Processing
The vulnerability is a use-after-free in Chrome’s XML processing code. A source report did not state a CVSS score for the flaw. Google credited an anonymous researcher with reporting it on November 6 and said it is aware that an exploit for the issue exists in the wild.
Google did not provide details on who is using the exploit or against whom, a common practice while a large share of users remain unpatched.
What a Freed-Memory Flaw Allows Through a Crafted Web Page
In a use-after-free, a program continues to use a block of memory after it has been released. An attacker who can craft a web page to trigger the condition can corrupt that freed memory, which can lead to code execution inside the browser context. Delivery requires a victim to load the malicious page, which makes drive-by and link-based attacks the practical route.
Chrome 157.0.8103.50 Fixes Nine Flaws Across Three Platforms
The patched builds are Chrome 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux. The same release addresses eight other security flaws in addition to the exploited zero-day.
Two of the other fixes sit close to the zero-day in the codebase or in the same class of bug. CVE-2026-125346 is another use-after-free in XML processing, and CVE-2026-125344 is a type confusion flaw in V8, Chrome’s JavaScript engine. Google’s advisory lists these among the additional fixes, but the available reporting does not say they are exploited.
Update Steps for Windows, macOS and Linux Chrome Users
Users can apply the update through Settings, then About Chrome, which triggers the download. A relaunch is required for the new version to take effect. Chrome typically stages updates in the background, but a browser left open for days can keep running the vulnerable build until it restarts.
Exploit Timeline Shows a Three-Day Gap Between Report and Patch
The interval between the November 6 report and the November 9 fix is short, and Google’s confirmation of in-the-wild use means attackers had a working exploit before or around the time the bug reached the vendor. Because the source does not say when exploitation began, the actual exposure window is unknown.
Chrome zero-days exploited before a patch exists have become a recurring feature of browser security, and memory-safety flaws such as use-after-free remain a frequent root cause. The pairing in this release of two XML use-after-free bugs, CVE-2026-125350 and CVE-2026-125346, shows the XML processing component receiving concentrated attention in the same update.
Enterprises that manage Chrome centrally have the same decision as individual users: confirm that managed browsers have reached 157.0.8103.50 or later and that they have restarted. Until that happens, a crafted page remains a path to code execution on any machine still running an earlier build, and Google has confirmed that at least one such page is circulating.
Chrome 157 Release Identifiers Administrators Should Match Against
The version strings differ slightly by platform, which matters for inventory checks. Windows and macOS builds ship as either 157.0.8103.50 or 157.0.8103.51, while Linux receives only 157.0.8103.50. A managed fleet reporting any earlier 157 build, or any build from an earlier major release, still carries CVE-2026-125350. The source report did not state a CVSS score for any of the nine fixes, so the exploitation confirmation from Google is the clearest indicator of urgency for this release.
