Google has released desktop and Android Chrome security updates addressing an actively exploited zero-day vulnerability. Security teams now face the task of deploying the fixes across managed devices.
The November 9, 2026, update addresses nine security flaws, including CVE-2026-125350, a high-severity vulnerability in Chrome's XML component. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 10.
The patches are rolling out in stages, making deployment verification essential. Google has not disclosed the attackers, their targets, or the extent of exploitation.
Chrome zero-day flaw and patched versions
In its November 9 security advisory, Google confirmed that an exploit for CVE-2026-125350 exists in the wild. An anonymous researcher reported the flaw on November 6.
The vulnerability is a use-after-free error (CWE-416), which occurs when software accesses previously released memory. The November 9 security advisory indicates that an attacker could execute arbitrary code inside Chrome's sandbox through a specially crafted HTML page.
CVE-2026-125350 carries a CVSS v3.1 score of 8.8, indicating high severity. Exploitation requires user interaction but no prior attacker privileges. A sandbox escape or full device compromise has not been publicly confirmed.
Previous Chrome zero-days in 2026 have also required urgent remediation, reinforcing the role of timely software security updates in limiting exposure.
Google released the following patched versions:
| Platform | Patched version |
|---|---|
| Windows and macOS | 157.0.8103.50 or .51 |
| Linux | 157.0.8103.50 |
| Android | 157.0.8103.50 |
| Windows and macOS Extended Stable | 156.0.8078.96 |
Google's Extended Stable release explicitly includes the fix. Its Android advisory says the mobile release includes corresponding desktop security fixes unless otherwise noted. CVE-2026-125350 is not listed individually.
CISA's KEV listing establishes November 24 as the applicable federal remediation deadline. Private organizations should prioritize remediation according to their exposure and risk.
Reducing exposure to CVE-2026-125350
Organizations should prioritize patching and verify that fixes have taken effect across managed devices. Continuous exposure management can help identify remaining vulnerable systems, while patch management solutions can support deployments across different endpoints.
Recommended mitigation measures include:
- Inventory and patch affected browsers: Identify vulnerable Chrome installations and deploy appropriate updates. Check other Chromium-based browsers against vendor advisories.
- Enforce restarts and verify updates: Require timely browser relaunches and confirm installed versions through endpoint management tools.
- Restrict malicious web access: Use DNS filtering and secure web gateways to block known malicious destinations. Limit sensitive application access from unpatched browsers where practical.
- Apply least privilege and browser hardening: Restrict unnecessary administrative permissions, retain browser isolation protections, and limit unapproved extensions.
- Monitor suspicious activity: Investigate unusual browser processes, crashes, and network connections using endpoint detection and response telemetry.
- Test incident response plans: Validate procedures for investigating suspected exploitation, isolating endpoints, preserving evidence, and restoring affected systems.
Desktop users can check for updates through Help → About Google Chrome, while Android users should use Google Play. Relaunching Chrome when prompted activates installed updates.
With exploitation confirmed, organizations should verify patch compliance and investigate credible signs of compromise. Additional security controls can reduce exposure but do not replace patching.
Read more: Google is also developing real-time Safe Browsing protections for Chrome's Incognito and Guest modes to improve detection of newly identified malicious websites.