Chrome Zero-Day CVE-2026-125350 Under Attack: Update Now
Chrome 157.0.8103.50 fixes an exploited use-after-free flaw in an XML component, now listed in CISA KEV. Edge, Opera and other Chromium browsers are at risk.
⚡ Why it matters
Simply visiting a booby-trapped web page can run attacker code inside your browser. The update is free and takes a minute, but it only takes effect after you restart the browser.
On November 9, 2026, Google released Chrome version 157.0.8103.50, which fixes nine vulnerabilities, including CVE-2026-125350, reported to be exploited in the wild.
What is the flaw?
According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), it is a use-after-free bug in an XML component that could let a remote attacker execute arbitrary code inside the sandbox through a crafted web page. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on November 10, with a federal patch deadline of November 24.
CISA notes that the flaw may affect other Chromium-based browsers, including Microsoft Edge and Opera. Ivanti's monthly roundup says it is the eighth exploited Chrome zero-day of 2026.
How to check and update
- Open the ⋮ menu, then Help, then About Google Chrome; the update starts automatically.
- Click Relaunch. The update is not complete until the browser restarts.
- Make sure the version is
157.0.8103.50or later. - Update Edge, Brave, Opera and other Chromium-based browsers as soon as their fixes are released.
In organizations, push the update through your management tools and track devices that have not restarted the browser in days.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.