Google urgently releases Chrome security update: fixes zero-day vulnerability already exploited in the wild, urges users to upgrade immediately.

November 10 — Google released an emergency stable channel update for desktop Chrome browsers on November 9, 2026, fixing 9 security flaws, including a zero-day vulnerability that has been exploited in the wild. The update pushes Chrome versions to 157.0.8103.50/.51 on Windows and Mac platforms, and to 157.0.8103.50 on Linux platforms, and will be rolled out gradually over the coming days to weeks.

The core focus of this update is the high-severity vulnerability tracked as CVE-2026-125350, a use-after-free issue in the XML component. Google explicitly stated in its advisory that it "is aware that CVE-2026-125350 has been exploited in the wild," but did not disclose the specific attack method, scale of victims, or attribution of the attack campaign. The vulnerability was reported by an anonymous researcher on November 6, 2026, only 3 days before Google released the fix.

Of all 9 fixes, 7 are rated "High" severity and 2 are rated "Medium" severity. In addition to CVE-2026-125350, another high-severity vulnerability, CVE-2026-125346, is also a use-after-free issue in the XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only flagged CVE-2026-125350 as exploited in the wild. The remaining high-severity vulnerabilities cover WebGL uninitialized resources, improper FileSystem authorization, compositor buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.

Google also confirmed that the Android version of Chrome (157.0.8103.50) released the same day contains the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the separately released update from November 9, with Windows and Mac versions at 156.0.8078.96, which also lists CVE-2026-125350 as a high-severity fix.

The Hong Kong Government Computer Emergency Response Team Coordination Centre (GovCERT.HK) issued a security alert the same day, defining affected systems as versions prior to Chrome 157.0.8103.50, and noted that successful exploitation of the relevant vulnerabilities could lead to remote code execution, denial of service, tampering, or security restriction bypass. The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) rated the risk level of this update as "Extremely High Risk."

Google stated in its announcement that access to vulnerability details and links may remain restricted until most users have completed the update. The company recommends that users manually check for and trigger the update via "Settings → About Chrome," and after completing the update, restart the browser for the patch to take effect. For users still running versions prior to Chrome 157.0.8103.50, the top priority is to confirm the version number and immediately restart to complete the upgrade.