Chrome Fixes Exploited XML Flaw: Update Browser Now

Chrome 157 Patches Nine Flaws, Including One Under Active Attack

Google has shipped a Chrome Stable channel update to version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, according to the official Chrome Releases blog, retrieved by Bellator Cyber Guard on November 11, 2026. The update fixes nine security vulnerabilities, and Google says one of them, CVE-2026-125350, already has a working exploit in the wild.

CVE-2026-125350 is a High-severity use-after-free vulnerability in Chrome's XML handling code. A use-after-free bug occurs when a program keeps using a block of memory after that memory has already been released back to the system, which attackers can sometimes manipulate to run their own code inside the browser or crash it outright. The flaw was reported to Google anonymously on November 6, 2026, and Google's advisory states only that 'Google is aware that an exploit for CVE-2026-125350 exists in the wild,' without detailing who is being targeted or how the exploit is being delivered.

That silence is standard practice, not evasiveness. Google's release notes explain that bug details and links stay restricted 'until a majority of users are updated with a fix,' so publishing exploit specifics now would hand attackers a head start against anyone who hasn't patched yet. Google has not disclosed which part of its XML handling is affected or how an attacker would reach the vulnerable code, beyond describing it in the advisory as a 'Use after free in XML.'

A second XML bug in the same update, CVE-2026-125346, is also a High-severity use-after-free flaw, reported by researcher Arni Hardarson of Neonix Security on October 12, 2026. Google has not flagged this one as exploited, but its presence alongside CVE-2026-125350 in the same release suggests Chrome's XML parsing code drew extra scrutiny from both outside researchers and attackers this cycle.

The remaining seven fixes are rated High or Medium severity and span several components: a WebGL uninitialized resource issue (CVE-2026-125345), an incorrect authorization bug in the FileSystem API (CVE-2026-125347), a Compositing buffer overflow (CVE-2026-125343), an out-of-bounds write in the GPU process (CVE-2026-125348), a V8 JavaScript engine type confusion bug (CVE-2026-125344), and two Medium-severity uninitialized resource issues in the GPU process (CVE-2026-125349 and CVE-2026-125342). None of those seven are flagged as exploited in Google's advisory.

What This Means For Your Business

Chrome is the default browser on most Windows and Mac business machines, which makes an actively exploited bug in it a same-week priority rather than a maintenance-window item. Healthcare practices running browser-based EHR portals, tax professionals logging into IRS e-services or state revenue sites, and any small business using Chrome for banking or payroll should treat this update as patch-now, not patch-eventually.

Three practical steps for readers:

• Open Chrome's three-dot menu, choose Help, then About Google Chrome, and confirm the version shown matches 157.0.8103.50/.51 on Windows and Mac or 157.0.8103.50 on Linux. If it doesn't match, click Relaunch.
• Don't let tabs sit open indefinitely. Chrome needs a full restart to load patched code, so a device that's never fully closed can keep running a vulnerable version for weeks without anyone noticing.
• Organizations managing Chrome through Chrome Enterprise or Chrome Browser Cloud Management should confirm their update policy isn't delaying rollout further than the active exploitation warning justifies. Google is staging its own rollout 'over the coming days/weeks,' so IT teams shouldn't assume every endpoint updates on day one without a deliberate push.

For practices and small businesses without dedicated IT staff, the safest default is to leave Chrome's automatic update mechanism enabled and simply close and reopen the browser at the start and end of each workday, which is enough to pick up fixes like this one as they roll out. Relaunching Chrome closes the gap for this specific flaw, but it is not a substitute for keeping automatic updates enabled going forward, since new vulnerabilities surface regularly.

Google's advisory does not name the attackers, the delivery method, or the targets behind CVE-2026-125350, and no separate government or vendor advisory on this specific flaw was available at the time of writing. Readers should treat any claims about the scope or targeting of this exploitation beyond what Google has published as unconfirmed until more detail becomes available once patch adoption is further along.