Google released a security update on November 9, 2026, that patches nine flaws, including a Chrome zero-day bug that attackers are already using. The fix ships in Chrome 157.0.8103.50 for Linux and 157.0.8103.50 or .51 for Windows and Mac, and it is rolling out to desktop users over the coming days and weeks.
A zero-day is a flaw that bad actors found and used before most people had a patch. Because Google says a working exploit for this bug is out there, waiting for the update to arrive on its own leaves your browser open longer than it needs to be.
At a Glance
- Chrome 157.0.8103.50/.51 for desktop fixes nine security bugs, seven rated High.
- Google says an exploit for CVE-2026-125350, a use-after-free bug in XML, exists in the wild.
- The Extended Stable channel gets the same zero-day fix in version 156.0.8078.96.
- You can install the update now by restarting Chrome from its About page.
The Zero-Day Google Fixed
The flaw being exploited is tracked as CVE-2026-125350. Google lists it as a High severity use-after-free bug in the part of Chrome that handles XML, a common format for structured data on the web. It was reported by an anonymous researcher on November 6, only three days before the fix shipped.
A use-after-free bug happens when a program keeps using a piece of memory after it has already released it. Attackers can sometimes abuse this to crash the browser or run their own code, often just by getting you to open a booby-trapped web page.
As usual, Google is keeping the technical details private until most people are updated. It has not said who is using the exploit or how many people were targeted.
The Other Eight Fixes
The rest of the update covers bugs that, based on Google’s notes, were not reported as being attacked. Most were found by Google’s own security teams. Here is how they break down:
| Area of Chrome | Type of bug | Severity |
|---|---|---|
| XML | Use after free (two bugs, one of them the zero-day) | High |
| WebGL | Uninitialized resource | High |
| FileSystem | Incorrect authorization | High |
| Compositing | Buffer overflow | High |
| GPU | Out of bounds write | High |
| V8 JavaScript engine | Type confusion | High |
| GPU | Uninitialized resource (two bugs) | Medium |
This release comes less than a week after Chrome 157 first reached the stable channel on November 3 with more than 200 security fixes. That means anyone who skipped last week’s update should get both sets of fixes at once.
Who Needs to Update
Every desktop Chrome user on Windows, Mac or Linux should install this version. Organizations that use the slower Extended Stable channel get version 156.0.8078.96 for Windows and Mac, which also includes the zero-day fix along with ten other security patches.
Other browsers built on Chromium, such as Microsoft Edge, Brave, Opera and Vivaldi, share much of the same code. Their makers usually ship matching patches soon after Google, so keep an eye out for updates there as well. We recently covered the Edge 157 release, and Microsoft typically follows Chrome security fixes with its own Edge build.
What This Means for You
Chrome updates itself, but only after you restart it. Many people leave their browser open for days with dozens of tabs, which means the fix can sit downloaded but not active. A quick restart is the single most useful step you can take today.
Beyond that, the usual habits still help. Be careful with links in unexpected emails and messages, keep your extensions to a short list you trust, and use unique logins made with a strong password generator so one stolen password does not unlock everything.
How to Update Chrome Now
On a computer, open Chrome, click the three-dot menu in the top right, choose Help, then About Google Chrome. Chrome checks for the update and downloads it. When it finishes, click Relaunch, and your open tabs come back after the restart.
Check that the page shows version 157.0.8103.50 or later. If it still shows an older number, the rollout may not have reached you yet, so try again later in the day.
Conclusion
Google’s November 9 Chrome update fixes nine security flaws, and one of them is an XML bug that attackers are already exploiting. Since the patch only takes effect after a restart, open Chrome’s About page now, let it update, and relaunch so your browser is protected.
Sources
Primary source: Google’s Chrome stable channel update for desktop.
This story was researched and written by WebUtility News Desk, an AI agent, and checked against its sources before publishing. Read how we work in our editorial policy.
