---
title: Chrome zero-day: Google patches CVE-2026-125350, a use-after-free in XML with an exploit in the wild, in Chrome 157.0.8103.50/.51 | ctxsec
url: https://ctxsec.com/items/chrome-157-0-8103-50-zero-day-cve-2026-125350-xml-uaf-exploited
description: "Google's Nov 9 Stable Channel update moves desktop Chrome to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux, with nine security fixes. Google says it is aware that an exploit for CVE-2026-125350, a High-severity use-after-free in XML reported anonymously on Nov 6, exists in the wild. The same build fixes a second XML use-after-free (CVE-2026-125346) and High bugs in WebGL, FileSystem, Compositing, GPU and V8. Extended Stable 156.0.8078.96 and Chrome for Android 157.0.8103.50 carry the fix too. Google hasn't shared details of the attacks."
status: "official (Chrome Releases blog, Nov 9, 2026: \"Google is aware that an exploit for CVE-2026-125350 exists in the wild\"); not yet in CISA KEV at publication; bug details restricted"
published: 2026-11-09
---

> Google's Nov 9 Stable Channel update moves desktop Chrome to 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux, with nine security fixes. Google says it is aware that an exploit for CVE-2026-125350, a High-severity use-after-free in XML reported anonymously on Nov 6, exists in the wild. The same build fixes a second XML use-after-free (CVE-2026-125346) and High bugs in WebGL, FileSystem, Compositing, GPU and V8. Extended Stable 156.0.8078.96 and Chrome for Android 157.0.8103.50 carry the fix too. Google hasn't shared details of the attacks.

[← Cybersecurity News](/news) · [markdown](/items/chrome-157-0-8103-50-zero-day-cve-2026-125350-xml-uaf-exploited.md)

official (Chrome Releases blog, Nov 9, 2026: "Google is aware that an exploit for CVE-2026-125350 exists in the wild"); not yet in CISA KEV at publication; bug details restricted

2026-11-09

### Chrome zero-day: Google patches CVE-2026-125350, a use-after-free in XML with an exploit in the wild, in Chrome 157.0.8103.50/.51

- **Patch:** desktop 157.0.8103.50 or later (.51 on some Windows/Mac builds); Extended Stable 156.0.8078.96; Android 157.0.8103.50. Rollout is staged, so force the update and relaunch rather than waiting.
- **Chromium-based browsers** (Edge, Brave, Opera, Vivaldi, Electron apps that bundle Chromium) need their own releases with the fix; check each vendor.
- The report-to-patch gap was three days, and the bug tracker entry stays restricted until most users update.

Sources: [Chrome Releases: Stable Channel Update for Desktop (Nov 9, 2026)](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html) · [Chrome Releases: Extended Stable Update for Desktop (Nov 9, 2026)](https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_0910980127.html) · [Chrome Releases: Chrome for Android Update (Nov 9, 2026)](https://chromereleases.googleblog.com/2026/11/chrome-for-android-update_01533302390.html)