Google has released desktop Chrome updates addressing CVE-2026-125350, a high-severity use-after-free flaw in XML. Its November 9 release notice confirms that an exploit exists in the wild.
The Stable builds are 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux. Google says distribution will take place over the coming days and weeks.
The release includes nine security fixes. The notice does not identify an attacker, affected organizations or the exploit’s delivery method. Google says access to technical bug information can remain restricted while users receive fixes.
A separate November 9 Extended Stable notice lists CVE-2026-125350 among the fixes in version 156.0.8078.96 for Windows and Mac. Teams using that channel should check its release rather than compare version numbers across channels.
Apply the update, then check the running browser
Google’s update instructions direct desktop users to the browser menu, then Help and About Google Chrome. That page displays the installed version and checks for updates. Select Relaunch when offered; the pending update takes effect after the browser restarts.
Linux users should update Chrome through their package manager. For an organization, verifying the version running after restart is more useful than assuming a downloaded update has already protected every open browser session.
Image: AI-generated editorial illustration created for DaySec.
