Google patches Chrome XML zero-day already exploited in the wild

What happened

Google fixed a Chrome for desktop flaw, CVE-2026-125350, in the November 9 Stable channel update. According to Google itself, an exploit for the flaw already exists in the wild. The flaw is rated High severity.

Why it matters

Chrome is the browser most employees use, and the flaw already has an exploit in circulation. Until machines are updated, a malicious website may be enough to compromise them; Google has disclosed no targets or details. The fix rolls out gradually over days or weeks.

What to do

Update the entire Chrome for desktop fleet: 157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux. Enterprises should push the Stable build through their management channel; users via Help and About Google Chrome.

For the technical team

CVE

CVE-2026-125350

Affected

Google Chrome para desktop · Google Chrome for desktop on versions prior to 157.0.8103.50/.51 (Windows/Mac) and 157.0.8103.50 (Linux).

Exploitation

Google states that an exploit for CVE-2026-125350 exists in the wild, which constitutes vendor-confirmed exploitation. The flaw was reported anonymously on November 6, 2026. No CISA KEV listing at packaging time, per DailyDarkWeb.

Fix

Chrome Stable 157.0.8103.50/.51 (Windows/Mac) and 157.0.8103.50 (Linux), in the November 9, 2026 Stable channel update. Gradual rollout over days or weeks. Update via Help, About Google Chrome, or by pushing the Stable build through the enterprise channel.

Vector

Use-after-free in Chrome for desktop's XML component. Bug details remain restricted until most users update; the exact exploitation condition was not disclosed in the sources.

More details

The Stable channel update includes 9 security fixes in total. No attribution to groups and no target details disclosed.

Timeline

1. 11/10/2026 12:23 AM

   Google shipped the fix in the November 9 Stable channel update and confirmed an exploit in the wild.

Sources 1 source

• @DailyDarkWeb @DailyDarkWeb

See all news