Google pushed a Chrome update on Monday covering nine vulnerabilities, one of which attackers had already been using.
The exploited flaw is tracked as CVE-2026-125350, a high severity use-after-free in the browser’s XML component. A researcher who asked not to be named reported it on November 6.
Eight in a single calendar year
This is the eighth Chrome zero-day exploited in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491. Google has not described the attacks behind the newest one, and CISA has not yet added it to the Known Exploited Vulnerabilities catalog.
What else shipped in the release
Six further high severity bugs were fixed in WebGL, FileSystem, Compositing, GPU, V8 and XML. Google’s own teams found most of them internally. Two low-key medium severity defects, both uninitialized resource issues inside the GPU component, were addressed as well.
The build to look for is Chrome 157. Windows and macOS users receive 157.0.8103.50 or 157.0.8103.51, while Linux jumps straight to 157.0.8103.50 with no second build listed. Desktop builds differ slightly by operating system, so the exact string matters when verifying a rollout.
Enterprise fleets should confirm the build number deployed rather than relying on auto-update status, since staggered rollouts leave machines on the prior branch for days. Any organization that treats Chrome as an attack surface for credential theft should treat this as an emergency patch.
