🔍 Read the full analysis: What Version Of Chrome Should You Install After The XML Bug? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Google released Chrome 157 on November 9 with a fix for high-severity XML use-after-free vulnerability CVE-2026-125350, which it says is being exploited in the wild. Install the patched version for your platform and restart Chrome; users of other Chromium-based browsers should check their vendor’s release notes because updates may arrive on a different schedule.
Google released Chrome 157 security updates on November 9, fixing CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component. Google says an exploit for the flaw exists in the wild, so users should install the patched version for their device and relaunch the browser rather than wait for the rollout to reach them.
Google lists these fixed versions: 157.0.8103.50/.51 for Windows and Mac, 157.0.8103.50 for Linux, and Chrome 157, version 157.0.8103.50, for Android. Organizations using the Extended Stable channel should install 156.0.8078.96 on Windows and Mac. Google says desktop updates will roll out over the coming days or weeks, while the Android release is expected on Google Play over the next few days.
To update desktop Chrome, open the three-dot menu, select Help, then About Google Chrome. The browser checks for and downloads an available update; users must select Relaunch to apply it. On Android, check Chrome’s Google Play listing for an Update option. Google says Android releases include the same security fixes as their corresponding desktop releases unless otherwise stated.
The November 9 release includes nine security fixes. A second XML use-after-free, CVE-2026-125346, is also listed, but Google has not said that it is being exploited. The company says the actively exploited bug was reported by an anonymous researcher on November 6, three days before the fix was published.
What Version of Chrome
Should You Install?
Google says a high-severity XML vulnerability is being exploited. Install the patched build for your platform and relaunch Chrome.
Install and restart
A downloaded update is not active until Chrome relaunches.
Open the three-dot menu, choose Help, then About Google Chrome.
Install the offered update and select Relaunch to apply it.
After restart, check the About page against the patched build for your platform.
Other Chromium browsers
Chrome updates do not update browsers made by other vendors.
| Browser | Reported status on November 10 | What to do |
|---|---|---|
| Vivaldi | Desktop update said to include a fix | Install the vendor update |
| Brave | Listed a release based on patched Chromium | Check release notes |
| Microsoft Edge | Fix still in progress | Monitor Microsoft’s advisories |
| Other Chromium browsers | Schedules vary by vendor | Check current release notes |
What the report establishes
Google identified the flaw as CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component.
- Google says an exploit exists in the wild.
- The vulnerability was reported November 6 and fixed in the November 9 release.
- How the exploit works or who is behind it.
- Who was targeted, or the scale and impact of attacks.
Install the Patched Chrome Build
The risk is not just that a vulnerability has been identified: Google says attackers are already exploiting it. That makes prompt installation more important than waiting for the browser’s automatic rollout. A downloaded update does not take effect until Chrome is restarted, so users should check the version shown on the About page after relaunching.
The affected component handles XML, a structured data format used in browser content such as SVG graphics and XML documents. Google has described the flaw as a use-after-free, a memory-management error in which software uses memory after it has been released. Such flaws can have different consequences, but Google has not published technical details about this bug or explained what attackers can do with it.
People using Edge, Brave, Vivaldi, Opera or another Chromium-based browser should not assume that installing Google’s Chrome update fixes their browser. Those products use Chromium but depend on their own vendors to package and distribute updates. The vendor status reported on November 10 differed: Vivaldi said a desktop update included a fix, Brave listed a release based on the patched Chromium version, and Microsoft said its Edge fix was still in progress.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
As an affiliate, we earn on qualifying purchases.
A Three-Day Report-to-Fix Timeline
Google’s Chrome Releases notes say the vulnerability was reported on November 6 and fixed in the update published November 9. The company has restricted details about the bug while the update rolls out. That limits what can be independently assessed about the vulnerability and the attacks, while reducing the risk of publishing technical information before users have had time to update.
The source report counted this as the eighth Chrome flaw in 2026 for which Google said it was aware of exploitation in the wild. That count comes from a review of Google’s release notes; it is not a measure of how many attacks occurred or how many people were affected. The same report noted that four of the eight flaws were in V8, Chrome’s JavaScript engine.
Chromium-based browsers can receive security fixes on separate schedules. As of November 10, Google’s notes did not include a Chrome iOS or ChromeOS update mentioning CVE-2026-125350. That is a status observation from the cited release notes, not confirmation that those products are affected or that no later update will address the issue.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google, in its Chrome security release notes
Attack Details Remain Restricted
Google has not disclosed who is behind the exploitation, who was targeted, or how the exploit works. The release notes provide no account of the attacks’ scale, impact, or required conditions. The term “in the wild” confirms reported exploitation, but does not establish how widespread it is.
Google says the desktop fix will roll out over the coming days or weeks, and the Android version is due on Google Play over the next few days. Availability may therefore vary by device and region. The source report found no relevant Chrome iOS or ChromeOS release note as of November 10; whether those platforms need a separate update was not established in the material available then.
Third-party browser status can also change quickly. The cited checks were made on November 10, and the source material did not list a fixed Microsoft Edge version or a new Opera release addressing the bug at that time. Users should consult the current release notes from their browser maker.
Check for Vendor Updates
Chrome users should open the browser’s About page, install the update if offered, and relaunch. After restarting, check that the installed version matches the patched release for the operating system. Android users should check Google Play and Chrome’s About Chrome screen as the update becomes available.
Users of other Chromium browsers should monitor their vendors’ security advisories and install the release that explicitly addresses CVE-2026-125350 or identifies an equivalent patched Chromium version. Google may publish further technical details after more users have received the fix, but no disclosure date was provided in the source material.
Key Questions
Which Chrome version should I install?
Install 157.0.8103.50 or .51 on Windows or Mac, 157.0.8103.50 on Linux, and Chrome 157, version 157.0.8103.50, on Android. Extended Stable users on Windows and Mac should use 156.0.8078.96.
How do I make sure the Chrome update is active?
Open the three-dot menu and go to Help, then About Google Chrome. Install any offered update and click Relaunch. Check the version again after the browser restarts.
Does Google say the XML bug is being exploited?
Yes. Google says it is aware of an exploit for CVE-2026-125350 in the wild. It has not disclosed who is responsible, who was targeted, or how the exploit works.
Does the Chrome update automatically fix Edge, Brave or Vivaldi?
No. Chromium-based browsers receive updates from their own vendors. Check your browser maker’s release notes and install its patched version; Chrome’s update does not by itself update those browsers.
What is not yet known about the vulnerability?
Google has not published technical details about the exploit, identified the attackers or targets, or described the scale and impact of the activity. The source material also did not identify a relevant Chrome iOS or ChromeOS update as of November 10, 2026.
Source: ThorstenMeyerAI.com
