Do Son 
TL;DR
Google has released Chrome 157.0.8103.50/.51 to fix nine security bugs, including a Chrome zero-day that attackers are already using. The flaw, CVE-2026-125350, is a use-after-free bug in Chrome’s XML component. In its advisory, Google says it “is aware that an exploit for CVE-2026-125350 exists in the wild.”
Why It Matters
A live exploit means attackers have a working weapon right now. An anonymous researcher reported the bug on November 6, 2026. Google shipped a fix only days later, which shows how urgent the threat is.
As usual, Google is holding back bug details. It explains that access “may be kept restricted until a majority of users are updated with a fix.” So far, Google has not said who is behind the attacks or who they target.
How the Attack Works
The zero-day
A use-after-free bug happens when software keeps using memory after it has freed it. An attacker who controls that memory can often corrupt data or run code. In browsers, a crafted web page usually triggers this kind of flaw.
Other fixes
The update also patches a second XML use-after-free (CVE-2026-125346) and a type confusion bug in the V8 engine (CVE-2026-125344). In addition, it fixes a Compositing buffer overflow, a GPU out-of-bounds write, a FileSystem authorization flaw, and three uninitialized resource bugs in WebGL and GPU code. Google has not reported exploitation for any of these eight flaws.
Affected Versions
- Chrome for Windows and Mac before 157.0.8103.50/.51
- Chrome for Linux before 157.0.8103.50
Patch and Mitigation
Open Settings, then About Chrome, and let the browser update. Next, click Relaunch to finish. Google’s Chrome Stable channel update for desktop notes that the rollout will take “days/weeks,” so check manually. Users of Edge, Brave, Opera and other Chromium browsers should watch for their own fixes for this Chrome zero-day.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
