Chrome CVE-2026-125350: Google says exploit exists in the wild — update now

Google says an exploit for Chrome CVE-2026-125350 exists in the wild. Practical guidance: update Chrome now.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Laptop displaying a red cracked code panel beside a blue shield with an update symbol.
Generated conceptual editorial illustration of a browser security update; not an official Google image or documentary evidence.

Security advisory candidate

Google says an exploit for Chrome CVE-2026-125350 exists in the wild.1

Practical guidance: Update Chrome now.15

Reporting cutoff: November 10, 2026, 05:28:47 UTC.

What is confirmed

Google rates CVE-2026-125350 High and describes it as a use-after-free vulnerability in XML.1

Chrome Stable is 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, with rollout over the coming days or weeks.1

Extended Stable is 156.0.8078.96 for Windows and macOS, also rolling out over the coming days or weeks; Google lists CVE-2026-125350 among that release’s fixes.2

Chrome 157.0.8103.50 for Android is rolling out through Google Play over the next few days; Google says Android releases contain the corresponding desktop security fixes unless otherwise noted.3

At the reporting cutoff, CVE-2026-125350 was not listed in CISA KEV catalog version 2026.11.09, released 2026-11-09T19:54:37.4945Z.4

Practical guidance

  1. On a computer, open Chrome, select the menu at the top right, then choose Help > About Google Chrome.5
  2. Let Chrome check for the update, then select Relaunch when that option appears.5
  3. After relaunch, verify the version shown on the About page is at least the applicable fixed build: 157.0.8103.50/.51 on Windows or macOS Stable, 157.0.8103.50 on Linux Stable, or 156.0.8078.96 on Windows or macOS Extended Stable.125
  4. On Android, install Chrome 157.0.8103.50 or later when Google Play offers it.3

What remains unknown

  • The reviewed Google desktop advisory provides no CVSS score or vector, actor attribution, campaign scale, exact affected-version floor, or public indicator of compromise for CVE-2026-125350.1
  • The CVE API lookup returned HTTP 404 at the reporting cutoff, so it supplies no independent score, vector, or affected-range record for this package.6
  • Absence from the cutoff-bounded CISA KEV capture does not contradict Google’s statement that an exploit exists in the wild.14

Sources

  1. Google Chrome Stable Channel Update for Desktop (retrieved 2026-11-10T05:28:46Z)
  2. Google Chrome Extended Stable Update for Desktop (retrieved 2026-11-10T05:28:46Z)
  3. Google Chrome for Android Update (retrieved 2026-11-10T05:28:46Z)
  4. CISA Known Exploited Vulnerabilities catalog (exact-ID observation at 2026-11-10T05:28:47Z)
  5. Google Chrome Help: Update Google Chrome (retrieved 2026-11-10T05:28:47Z)
  6. CVE Program API lookup for CVE-2026-125350 (HTTP 404 observation at 2026-11-10T05:28:46Z)

Browse Articles

Latest Articles