Google has released an update to the stable Chrome channel to versions 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux, fixing nine security vulnerabilities. One of them — CVE-2026-125350, a use-after-free bug in the XML component — is already being exploited by attackers. Google confirms: “an exploit for CVE-2026-125350 exists in the wild.” The vulnerability was added to the CISA KEV catalog on 10 November 2026 with a remediation deadline of 24 November 2026. All Chrome users and users of Chromium-based browsers need to update immediately.
Actively exploited vulnerability: CVE-2026-125350
Use-after-free is a class of memory management errors in which a program accesses a memory region after it has been freed. Successful exploitation of such vulnerabilities can lead to data corruption, process crashes, or arbitrary code execution. CVE-2026-125350 affects the XML processing component in Chrome and has been rated High by Google. The vulnerability was reported by an anonymous researcher on 6 November 2026, and the patch was released on 9 November — just three days later.
Google is not disclosing exploitation details: the attack mechanism, specific targets, and threat actors behind the attacks remain unknown. A CVSS score had also not been assigned at the time of publication. Access to the bug report details is restricted until most users have received the update.
Connection between two XML vulnerabilities through shared code
A notable technical detail: this update fixes two use-after-free vulnerabilities in XML — CVE-2026-125350 and CVE-2026-125346 (discovered by Arni Hardarson of Neonix Security on 12 October 2026). According to the commit log for the Chrome 157 branch, both issues were fixed by a single patch that corrects a use-after-free in the direct pattern match cache in the libxslt library. This means both CVEs are tied to the same vulnerable code execution path, giving security teams a single validation point when checking whether the update has been applied.
Complete list of fixed vulnerabilities
In addition to the actively exploited CVE-2026-125350, the update closes eight more vulnerabilities — seven rated High and two of Medium severity:
- CVE-2026-125345 (High) — uninitialized resource in WebGL
- CVE-2026-125347 (High) — improper authorization in FileSystem
- CVE-2026-125343 (High) — buffer overflow in Compositing
- CVE-2026-125348 (High) — out-of-bounds write in GPU
- CVE-2026-125344 (High) — type confusion in V8
- CVE-2026-125346 (High) — use-after-free in XML (described above)
- CVE-2026-125349 (Medium) — uninitialized resource in GPU
- CVE-2026-125342 (Medium) — uninitialized resource in GPU
Most of the vulnerabilities were discovered by Google’s internal teams between July and October 2026. External researchers — Arni Hardarson (Neonix Security), Vo Duc Thang, and an anonymous reporter — reported three out of the nine issues.
Impact assessment
All users of desktop versions of Google Chrome on Windows, macOS, and Linux are at risk, as well as users of Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi. The vulnerability set affects critical components: the graphics engine (WebGL, GPU, Compositing), the V8 JavaScript engine, the file system, and XML processing. Type confusion vulnerabilities in V8 and out-of-bounds writes in the GPU have historically been among the most dangerous for browser attacks, as they can lead to arbitrary code execution in the context of the renderer process.
Previously, we wrote about creating working exploits for Chrome — this case confirms that browser vulnerabilities remain a priority target for attackers.
Recommendations
CVE-2026-125350 should be at the top of your vulnerability remediation plan: it is the only one of the nine vulnerabilities that Google confirms is being exploited in the wild. The remaining eight vulnerabilities should be treated as high priority but secondary.
- Update Chrome to version 157.0.8103.50 (Linux) or 157.0.8103.50/.51 (Windows, macOS). To do this, open Menu → Help → About Google Chrome and restart the browser.
- Check deployed versions in corporate environments. Google notes that the update “will roll out over the coming days or weeks,” so automatic updates do not guarantee immediate coverage of the entire device fleet.
- Update Chromium-based browsers — Edge, Brave, Opera, Vivaldi — as soon as the respective vendors release patches.
- For organizations subject to CISA requirements: the remediation deadline for CVE-2026-125350 is 24 November 2026.
The lack of public details about the exploit does not reduce the urgency: Google is intentionally limiting information until users have been widely updated. The only reliable protection measure is to install the patch. Given that the update fixes two related vulnerabilities in libxslt with a single commit, verifying the browser version simultaneously confirms that both XML processing issues have been closed.
