Google says a Chrome zero-day, CVE-2026-125350, is being exploited, and its November 9 Chrome 157 update fixes it. The bug is a use-after-free flaw in Chrome’s XML handling. Google rated it High. The fixed desktop versions are 157.0.8103.50 and 157.0.8103.51 for Windows and Mac, and 157.0.8103.50 for Linux.
This post is for IT teams at nonprofits, associations, schools and agencies that manage browsers for staff. It covers what Google has published, the fixed version for each channel, how to check your fleet, and how to force the update with Chrome Enterprise Core, Intune or Group Policy. It also covers Microsoft Edge and other Chromium-based browsers, which share Chrome’s engine. Facts are as of the morning of November 10, 2026.
The short version: get every Chrome install to 157.0.8103.50 or later today, or to 156.0.8078.96 if you run the Extended Stable channel. Chrome downloads updates on its own, but the fix does not take effect until the browser relaunches. A forced relaunch policy closes that gap. Microsoft said on November 9 that it is working on an Edge fix, so watch for it and push it as soon as it lands.
What Google says about the Chrome zero-day
Google’s November 9 Stable Channel Update for Desktop lists nine security fixes. One line matters most: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." That is Google’s standard wording for a Chrome zero-day, a bug attackers used before a fix existed.
According to the post, the flaw is a "Use after free in XML." An anonymous researcher reported it on November 6, 2026. Google shipped the fix three days later.
A use-after-free bug happens when a program frees a piece of memory and then keeps using it. An attacker who can control what lands in that memory can sometimes run code. In a browser, the usual trigger is a crafted web page. Google has not said how this Chrome zero-day is delivered or who is using it.
Google’s post also says bug details "may be kept restricted until a majority of users are updated with a fix." So expect few technical details for now. Plan around the fixed version, not around waiting for more facts.
The same update fixes a second XML use-after-free bug, CVE-2026-125346, reported on October 12 by Arni Hardarson of Neonix Security. Google does not mark that one as exploited.
Fixed versions by channel and platform
Google published separate posts for each channel. Here is where each one stands as of the morning of November 10, 2026.
| Channel or platform | Fixed version | Source |
|---|---|---|
| Stable, Windows and Mac | 157.0.8103.50 or 157.0.8103.51 | Google, November 9 desktop post |
| Stable, Linux | 157.0.8103.50 | Google, November 9 desktop post |
| Extended Stable, Windows and Mac | 156.0.8078.96 | Google, November 9 Extended Stable post |
| Android | 157.0.8103.50 | Google, November 9 Android post |
Google’s Extended Stable update lists CVE-2026-125350 among its 11 security fixes. If you moved some machines to Extended Stable for slower feature changes, they still get this fix.
The Chrome for Android post says version 157.0.8103.50 will reach Google Play "over the next few days." It adds that Android releases carry the same security fixes as the matching desktop release unless noted.
Google says both desktop updates roll out "over the coming days/weeks." For a Chrome zero-day, that rollout window is too slow to leave alone. The steps below speed it up.
We did not find a ChromeOS stable update carrying the fix on Google’s release blog. The most recent ChromeOS stable post, dated November 6, lists browser version 156.0.8078.93, which is older than the fixed Extended Stable build. If you manage Chromebooks, watch the blog for the next ChromeOS stable update.
How to check one browser
On any single computer, open Chrome and go to More, then Help, then About Google Chrome. Google’s update help page says the version number appears under the "Google Chrome" heading. Chrome checks for updates while that page is open.
If an update is waiting, a Relaunch button appears. If there is no Relaunch button, that copy of Chrome is current. Users who pick "Not now" get the update the next time Chrome restarts. Tabs reopen after a relaunch, but Incognito windows do not, so warn staff before you force one.
That works for a handful of machines. For a fleet, use reports and policy.
How to check your whole fleet
If you enroll browsers in Chrome Enterprise Core, the Google Admin console has a version report. Google’s version report article gives the path as Menu, then Devices, then Chrome, then Reports, then Versions.
The report counts managed browsers by version and platform. It includes devices that reported in the last 28 days. Chrome browser reporting must be turned on first, so check that setting if the report looks empty.
If you use Intune, Jamf or another endpoint tool, run its software inventory report for Google Chrome. Look for any version below 157.0.8103.50, or below 156.0.8078.96 on Extended Stable.
Our post on Chrome’s two-week release cycle explains why version reports matter more now. Fixes ship more often, and fleets fall behind faster.
How to force the Chrome zero-day fix with policy
Chrome downloads the update by itself. The gap is the relaunch: the patched code does not run until Chrome restarts.
Make Chrome relaunch on a deadline
Chrome’s RelaunchNotification policy has three states. Not set, Chrome only changes its menu to hint at a relaunch. Recommended, users see a recurring warning they can dismiss. Required, users see the warning and Chrome forces a relaunch when the notice period ends.
The RelaunchNotificationPeriod policy sets that period in milliseconds. Google’s default is 604,800,000, which is seven days for Chrome. ChromeOS defaults to four days.
Our suggestion for this week: set RelaunchNotification to Required and shorten the period. One day is 86,400,000 milliseconds. Tell staff first so a forced restart does not land in the middle of a webinar or a donation import.
Chrome Enterprise Core
Set both as browser policies in the Admin console. Open chrome://policy on a machine to confirm.
Intune
Google’s article on managing Chrome with the Intune Settings Catalog gives the path. Go to Devices, Windows, Configuration Profiles, Create Profile. Pick Windows 10 and later and the Settings Catalog profile type. Search for "Chrome," add the settings you need and assign them. On a device, open chrome://policy and select Reload policies to check.
Group Policy
Google’s update management article puts the update settings under Computer Configuration, Policies, Administrative Templates, Google, Google Update. Check that "Update policy override" is not set to "Manual updates only" or "Disable updates." Google says plainly: "We do not recommend turning off browser updates."
Check for a "Target version prefix override" too. That setting pins Chrome to a version. Google says pinning should be temporary. A pin left in place from an old project can hold machines below the fixed version.
Microsoft Edge and other Chromium-based browsers
Edge, Brave, Opera, Vivaldi and other browsers run on Chromium, the open-source project behind Chrome. A Chromium bug usually reaches them too, but each vendor ships its own fix on its own schedule.
Microsoft’s Edge security release notes carry this November 9 entry: "Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix." The note does not name a CVE. The timing points to this Chrome zero-day, but Microsoft has not confirmed that.
As of the morning of November 10, the newest Edge Stable release in those notes is 157.0.4341.42, dated November 5. That predates Google’s fix. So Edge users are waiting on Microsoft. Check the notes during the day, and push the new Edge build through your update tool as soon as it appears.
For Brave, Opera, Vivaldi and others, check each vendor’s release notes for a build that includes the Chromium fix. If staff installed these browsers on their own, they may sit outside your patch process. A software inventory report will find them. Our guide to browser engines in 2026 lists which browsers share Chromium.
CVE record and KEV status
As of November 10, the CVE record for CVE-2026-125350 is still in the "Reserved" state, with no public details yet. Google’s release post is the authority for now.
CISA’s Known Exploited Vulnerabilities catalog did not list this Chrome zero-day in its November 9 version. CISA often adds exploited Chrome bugs within days of Google’s notice. A listing would add a deadline for US federal agencies, and many state and local teams follow it too. Do not wait for it. Google’s statement that an exploit exists is enough reason to act.
If CVE and KEV terms are new, start with what a CVE is and our explainer on EPSS scores. Our post on the exploited GitLab vulnerability shows what a KEV listing looks like once it lands.
This is not the first Chromium zero-day of 2026
Microsoft’s Edge security notes list seven earlier Chromium flaws in 2026 that the Chromium team reported as exploited in the wild. They are CVE-2026-2441, CVE-2026-3910, CVE-2026-3909, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491. That makes CVE-2026-125350 at least the eighth this year.
The lesson for a small IT team is about process. A Chrome zero-day is now a routine event. A relaunch policy, a version report and a named person who checks it will handle most of them without a fire drill.
This bug also sits in XML handling. Chrome is already removing XSLT, a related XML feature, as we covered in our post on Chrome XSLT removal. Google has not tied the two together, and the fix does not depend on that change.
Frequently Asked Questions
What is CVE-2026-125350?
It is a use-after-free bug in Chrome’s XML handling, rated High by Google. Google says an exploit for it exists in the wild. It is fixed in Chrome 157.0.8103.50 and 157.0.8103.51, and in Extended Stable 156.0.8078.96.
Which Chrome version fixes the Chrome zero-day?
On Windows and Mac, 157.0.8103.50 or 157.0.8103.51. On Linux, 157.0.8103.50. On Extended Stable, 156.0.8078.96. On Android, 157.0.8103.50 from Google Play.
Is Chrome updated automatically?
Chrome downloads updates on its own, but the fix runs only after the browser relaunches. Google also rolls updates out over days or weeks. Check the version and relaunch, or force it with the RelaunchNotification policy.
Is Microsoft Edge affected?
Microsoft posted on November 9 that it is aware of recent exploits in the wild and is working on a fix. The note does not name a CVE. As of the morning of November 10, the newest Edge Stable build in the notes, 157.0.4341.42 from November 5, predates Google’s fix.
What about Brave, Opera and Vivaldi?
They use Chromium, so they likely share the bug. Each vendor ships its own fix. Check their release notes and update as soon as a build with the Chromium fix appears.
How do I force Chrome to relaunch?
Set the RelaunchNotification policy to Required and set RelaunchNotificationPeriod to a short period in milliseconds. The default period is seven days. You can set both through Chrome Enterprise Core, Intune or Group Policy.
Is the Chrome zero-day on CISA’s KEV list?
Not in the November 9 version of the catalog. CISA may add it later. Google’s statement that an exploit exists is reason enough to patch now.
How are attackers using it?
Google has not said. It restricts bug details until most users have the fix. A browser bug like this is usually triggered by a crafted web page.
Do Chromebooks need anything?
As of the morning of November 10, we had not found a ChromeOS stable update with this fix on Google’s release blog. The last ChromeOS stable post, from November 6, lists browser 156.0.8078.93. Watch the blog for the next ChromeOS update.
