Chrome has a new zero-day with an exploit in the wild. Update to 157.0.8103.50 and restart the browser

By George Bailey   Published: 11/11/26   4 min read
Cyber News

Google shipped an emergency Chrome update on Monday for a bug that attackers already have a working exploit for. It is the eighth Chrome zero-day of 2026, according to SecurityWeek, and CISA added it to its exploited list on Tuesday.

Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.

Chrome updates itself, but the fix does nothing until the browser restarts. Laptops that stay open for weeks are the ones still exposed.

Chrome downloaded the fix. It is not running until someone restarts the browser. Version 157.0.8103.50 or later.

Chrome patches an XML bug already used in attacks

CVE-2026-125350 is a use-after-free in Chrome’s XML component, rated High. Google’s release note says it “is aware that an exploit for CVE-2026-125350 exists in the wild.” An anonymous researcher reported it on November 6, three days before the fix.

Google has not said who is using it or against whom. CISA’s catalog entry says a crafted web page can run code inside the browser sandbox, and that other Chromium browsers such as Microsoft Edge and Opera can be affected.

Any desktop or phone that has not relaunched Chrome since Monday

A browser bug only needs a user to load a page, through a link in an email, a poisoned ad or a compromised site. Use-after-free bugs like this one are often paired with a second flaw to break out of the sandbox, which is why Google moves fast on them.

Google says the update rolls out “over the coming days/weeks.” Managed fleets that pin versions, kiosks, and Chromium browsers that lag Google are the gaps. We covered the first Chrome 157 release on November 4; this is a newer build.

Get every browser to 157.0.8103.50 and restart it

Forward this

For whoever manages our laptops and browsers: Google fixed a Chrome bug that attackers are already exploiting. The update downloads on its own but only takes effect after Chrome restarts. Can we push a forced relaunch so every machine is on 157.0.8103.50 or later this week?

Details

Hunt / verify

Source: Google Chrome release note, November 9; CISA KEV alert, November 10

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].