Google has fixed another Chrome flaw that attackers are already using. It is tracked as CVE-2026-125350, it is the eighth exploited Chrome zero-day of 2026, and the fix only reaches you once Chrome restarts. The good news: updating takes about a minute.
What happened
On November 9, 2026 Google pushed a Stable update that patches nine security bugs. One of them, CVE-2026-125350, is a use-after-free in Chrome's XML component, rated High (CVSS 8.8). Google's release note says it "is aware that an exploit for CVE-2026-125350 exists in the wild". In plain words: a booby-trapped web page could run code inside the browser sandbox on an unpatched Chrome.
Google has not said who is behind the attacks or who is being targeted. As usual, the technical details stay locked until most users have the fix.
Which Chrome version is safe?
- Windows and Mac: 157.0.8103.50 or 157.0.8103.51, or anything newer.
- Linux: 157.0.8103.50 or newer.
- Extended Stable (mostly managed work PCs): 156.0.8078.96.
- Android: the matching Chrome build is rolling out on Google Play over the next few days.
How to update Chrome on Windows, Mac or Linux
- Open Chrome and click the three dots at the top right.
- Go to Help > About Google Chrome. Chrome checks for the update and downloads it on its own.
- Click Relaunch. Your tabs come back after the restart.
- Open the same page again and check the version number against the list above.
If the button says "Chrome is up to date" but you still see version 156 or older, wait a few hours: Google rolls updates out in waves. Quitting Chrome completely (not just closing the window) and opening it again often triggers the download.
How to update Chrome on Android
- Open the Play Store, tap your profile picture, then Manage apps & device.
- Under Updates available, find Chrome and tap Update.
- If Chrome is not listed yet, the build has not reached your phone. Check again tomorrow.
Do other browsers need the fix too?
Edge, Brave, Opera and Vivaldi are built on Chromium, the same engine as Chrome. They usually ship the fix a few days after Google. Open their "About" page the same way and install anything that is waiting.
Quick answers
Is my data at risk if I already visited a bad page?
Google has not published what the attacks do after the first step. Updating closes the hole. If you have reasons to worry, change the passwords of your important accounts and turn on two-step verification.
Does Chrome update by itself?
Chrome downloads updates in the background, but the fix only applies after a relaunch. If you never close your browser, you are probably still on the old version.