Vulnerabilities
Patch Chrome now: eighth exploited zero-day of 2026
Google patched CVE-2026-125350, an exploited use-after-free in Chrome's XML engine. It is the eighth Chrome zero-day of 2026, and a restart is the real fix.
Google has released Chrome 157.0.8103.50 to fix CVE-2026-125350, a high-severity use-after-free flaw in the browser's XML component that attackers are already exploiting. The fix reached the stable channel around November 9, with Windows and Mac also getting build .51 and Linux on .50. Because every Chromium-based browser shares this code, the same problem reaches Microsoft Edge, Brave, Opera and Vivaldi, and each needs its own matching update.
This is the eighth actively exploited Chrome zero-day Google has patched in 2026. An anonymous researcher reported it on November 6, and the fix shipped within days. Google says an exploit exists in the wild but has shared almost nothing else, no attacker, no target and no description of what the exploit achieves, which is its usual practice until most users have updated. One detail matters more than any of that for your own machines: the update changes nothing until the browser is restarted.
How a use-after-free in XML parsing runs code
Chrome parses XML, a text format for structured data, whenever a page serves it directly or embeds it. Part of that handling is XSLT, which stands for Extensible Stylesheet Language Transformations, the old engine that turns an XML document into HTML a browser can display. It is legacy code that has processed untrusted content from the open web for two decades, and it is the area one report ties this flaw to. Google's own wording is broader: it names the XML component without singling out XSLT.
A use-after-free is a memory-management bug. The parser frees a block of memory that held an object it no longer needs, but a pointer somewhere still refers to that freed block. If the code reaches through that stale pointer later, it reads or writes memory that may now hold something else entirely. An attacker who can time the free and then place controlled data into the same slot gets the program to treat attacker data as a live object. From there they can steer where the code jumps and what it executes.
The trigger is a web page. A crafted XML or XSLT payload served by a site you visit, or embedded in a page or an ad on it, is enough to set off the sequence. There is no download to open and no button to click beyond loading the page. Flaws in the rendering engine normally land inside Chrome's sandbox, the isolated process that is supposed to contain a compromised tab, so turning one into full control of the machine usually needs a second bug chained to it. Google has not said whether this exploit does that, which is part of what it is withholding.
What Google has confirmed, and what it has not
Google's advisory states that an exploit for CVE-2026-125350 exists in the wild. It is holding back the technical specifics, including which group is using it and against whom, until a majority of users have moved to the fixed build. That is the standard pattern for an exploited zero-day: publish enough to make people update, withhold enough that the details do not help other attackers reproduce it before fleets catch up.
The same release fixed several other flaws alongside the exploited one, a mix of high and medium severity, though those are not known to be under attack. The running tally for 2026 is the part worth sitting with. Eight browser flaws have been found exploited in the wild before a patch existed this year, hitting the JavaScript engine repeatedly, the styling engine, the graphics layer and now XML handling. Each one was a working attack against the default browser on most corporate desktops, caught only after it was already in use.
What to do
Get to the fixed build and restart. The two are separate actions, and the second is the one people skip.
- Check the version. Open
chrome://settings/help. Chrome checks for updates when that page loads. You want 157.0.8103.50 or later on Linux, or 157.0.8103.50 / .51 on Windows and Mac. - Restart. If the page shows a Relaunch button, the new code is downloaded but not running yet. Click Relaunch, or close every Chrome window and reopen. A browser left open for days is still running the vulnerable build no matter what the version string downloaded in the background.
- On managed fleets, force the relaunch. Confirm the rollout on a sample machine at
chrome://policy, which lists the policies actually applied. Use the RelaunchNotification policy, set through Chrome Browser Cloud Management or the Chrome ADMX templates in Group Policy, to require a relaunch within a deadline rather than leaving it to each user. Without that, the update sits unapplied on the exact machines that stay logged in all week. - Update Edge and the other Chromium browsers. Microsoft ships Edge's matching fix on its own schedule, so check
edge://settings/helpand restart Edge too. Brave, Opera and Vivaldi each need their own update. Treat the fleet as patched only once every Chromium browser on it has taken the fix and been relaunched.
There is a second lever for the XSLT angle. Microsoft is moving to disable browser-native XSLT by default in Edge because the aging code processes untrusted input, and it offers the XSLTEnabled policy to control the behaviour in the meantime. If your organisation does not rely on client-side XSLT, leaving it disabled removes one class of these bugs from the attack surface regardless of the next patch.
The gap that actually gets exploited
Eight pre-patch zero-days in one year tells you the browser is a front line, not a solved problem. For most teams the real exposure is not whether a fix exists, it is the gap between the update downloading and the browser restarting. That gap can run for days across an estate of people who never close their tabs, and it is invisible unless someone is enforcing relaunch and reading chrome://policy to confirm it took. The version number in a management console is not the same as the version running in memory.
Knowing which browsers and builds are actually live across your estate, and closing the settings that leave them exposed, is the work our safeguarding and hardening team does with your own engineers, and our attack surface management work keeps the inventory of what you expose current as it changes. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: SecurityWeek, BleepingComputer, eSecurity Planet on Chrome 157, Microsoft Message Center on Edge XSLT.