Google shipped an emergency Chrome stable channel update on November 9, 2026, to patch a Chrome zero-day that attackers are already exploiting. CVE-2026-125350 is a use-after-free bug in Chrome’s XML handling, and Google says on its own Chrome Releases blog that it is “aware that an exploit for CVE-2026-125350 exists in the wild.” The fix ships as version 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux.
What This Chrome Zero-Day Patch Covers
Nine security fixes shipped in total, all rated High or Medium severity, no Criticals this round. CVE-2026-125350 is the one under active attack, reported by an anonymous researcher on November 6, just three days before the patch went out. The other eight sit in components that have been recurring trouble spots for Chrome all year: WebGL, FileSystem, a Compositing buffer overflow, three separate GPU bugs, a V8 type confusion flaw, and a second use-after-free in XML that independent researcher Arni Hardarson flagged back in October. Google hasn’t said how CVE-2026-125350 is being exploited, only that it’s happening, which is standard practice while the fix is still rolling out to the full user base. According to The Hacker News, this is the eighth actively exploited Chrome zero-day Google has had to patch so far in 2026.
Who Should Care and What to Do
This lands just six days after Chrome 157’s initial stable promotion patched 213 other flaws, so anyone who already updated for that release still has to update again: the build number has moved from 157.0.8103.38/.39 to 157.0.8103.50/.51. Chrome downloads the fix automatically, but it only applies after a restart. Check chrome://settings/help to confirm which build is actually running.
An actively exploited zero-day sits in a different risk tier than a batch of bugs with no known exploit. It means working attack code already exists, not a theoretical path someone might eventually find. That is worth treating with more urgency than the usual update-when-convenient approach, especially on any machine used to manage a live site: a WordPress dashboard, a Webflow Designer session, a staging environment. Restarting the browser is the only real defense most people have against a bug they cannot see coming, and it costs nothing to do today instead of next week.
