Google has patched an actively exploited zero-day in Chrome’s XML component, warning that attackers already possess working exploit code. The fix arrived November 9 in Chrome 157.0.8103.50 for Linux and Chrome 157.0.8103.50/.51 for Windows and macOS, with the Stable-channel release rolling out over the coming days and weeks, according to Google’s security advisory.
The vulnerability, tracked as CVE-2026-125350, is a high-severity use-after-free in Chrome’s XML processing code. Google said it was notified by an anonymous researcher on November 6 and that “an exploit for CVE-2026-125350 exists in the wild.” The company has not disclosed the attack method, targets, impact, or identity of the attackers.
A use-after-free occurs when software continues to use memory after returning it to the system. In a browser, successful exploitation can potentially corrupt process memory and undermine security boundaries, although Google has not publicly confirmed what the observed exploit achieves. As of November 10, the NVD page did not provide a CVSS score or a detailed public record for this newly disclosed CVE, and no public proof of concept or threat-actor attribution has been established.
The update addresses nine security defects in total. Google rated seven of them High, including additional XML, V8, WebGL, FileSystem, compositing and GPU issues, while two GPU flaws received Medium ratings. Google is restricting technical details and exploit links until more users have installed the fixes, a standard precaution that limits information available to attackers while the patch propagates.
Organizations should prioritize Chrome across managed desktops rather than wait for the staged rollout to complete. Users can verify their status by opening Chrome’s menu and selecting Help followed by About Google Chrome; the browser will check for the update and display a Relaunch button when it is ready. Closing and reopening Chrome also helps automatic updates complete, while administrators should confirm that fleet reporting shows the patched 157 builds rather than relying solely on browser launchers or endpoint inventory.