Google's Chrome Releases blog says the Stable channel was updated on Monday 9 November 2026 to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out over the coming days and weeks, with 9 security fixes.

Google says it is aware that an exploit for CVE-2026-125350 exists in the wild; Chrome rates it High and describes it as a use after free in XML, reported by an anonymous researcher on 6 November 2026. The other fixes listed are High-rated CVE-2026-125345 (uninitialised resource in WebGL), CVE-2026-125347 (incorrect authorisation in FileSystem), CVE-2026-125343 (buffer overflow in Compositing), CVE-2026-125348 (out of bounds write in GPU), CVE-2026-125344 (type confusion in V8) and CVE-2026-125346 (use after free in XML; since rejected as a duplicate of CVE-2026-125350, see correction), and Medium-rated CVE-2026-125349 and CVE-2026-125342 (uninitialised resource in GPU).

Google says access to bug details may be kept restricted until a majority of users are updated (source: Chrome Releases).

Google also released Chrome 157 (157.0.8103.50) for Android, which it says contains the same security fixes as the desktop release unless otherwise noted (source: Chrome Releases). Google has not shared additional details about the attacks, and the flaw is the eighth Chrome zero-day exploited in attacks this year, according to BleepingComputer.

UPDATE (11 Nov 2026, Perth): CISA added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on 10 November 2026 as a Google Chromium XML use-after-free that could affect multiple Chromium-based browsers, including Chrome, Microsoft Edge and Opera; the US federal due date is 24 November 2026. (source: CISA KEV)

Correction (12 Nov 2026): this card listed CVE-2026-125346 as a separate High-rated fix. Its CVE record now marks it REJECTED (11 November 2026, UTC) with the reason 'Duplicate CVE. Replaced by CVE-2026-125350', so the XML use-after-free is tracked only as CVE-2026-125350. (source: CVE-2026-125346 record on cve.org)