Google updates Chrome to fix actively exploited zero day

Google has issued a security update for Chrome on 9 November 2026, rolling out to Stable users on Windows, macOS and Linux. The desktop update brings Chrome to version 157.0.8103.50/51 for Windows and Mac, and 157.0.8103.50 for Linux, and includes nine security fixes, one of which addresses an actively exploited zero-day. HKCERT rates the overall risk as Extremely High, noting that some fixes could prevent denial of service, security restriction bypass and remote code execution.

The zero-day, tracked as CVE-2026-125350, is a high-severity use-after-free vulnerability in Chrome’s XML component, which handles structured web content. Google says it was notified about the flaw by an unnamed third party on 6 November 2026 and confirms that an exploit exists in the wild. The company has not disclosed details on the attackers, targets, delivery method or the full impact of the exploit, stating only that exploitation is known to be active in real-world abuse.

Google recommends updating Chrome promptly. Users can allow automatic updates or update manually via About Google Chrome in Settings or Help, after which a Relaunch is required to apply the update. Google also notes Chrome 157.0.8103.50 for Android, released on 9 November, with the same security fixes unless stated otherwise; Android users should check Google Play for the update.