BlockBeats news: On November 10, Google released an emergency stable channel update for the desktop version of Chrome browser, effective November 9, 2026, fixing nine security vulnerabilities, including a zero-day exploit actively being used in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.0.8103.50/.51, and to 157.0.8103.50 on Linux, with gradual rollout expected over the coming days to weeks.
The core focus of this update is the critical vulnerability numbered CVE-2026-125350, classified as a use-after-free in an XML component. Google explicitly stated in its advisory that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, scale of impact, or attribution of the attacks. The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the patch.
Of the nine fixed issues, seven are classified as "High" severity and two as "Medium" severity. In addition to CVE-2026-125350, another high-severity vulnerability, CVE-2026-125346, is also a use-after-free issue in the XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026; however, Google only marked CVE-2026-125350 as being exploited in the wild. The remaining high-severity vulnerabilities include uninitialized WebGL resources, improper FileSystem permissions, compositor buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.
Google also confirmed that the Android version of Chrome (157.0.8103.50), released on the same day, includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the separate update released on November 9, with versions 156.0.8078.96 for Windows and Mac, which also lists CVE-2026-125350 as a high-priority fix.
On the same day, the Government Computer Emergency Response Team Hong Kong (GovCERT.HK) issued a security alert, defining affected systems as versions prior to Chrome 157.0.8103.50, and noted that successful exploitation of the vulnerability could lead to remote code execution, denial of service, tampering, or security restriction bypass. The Hong Kong Computer Emergency Response Team (HKCERT) rated the risk level of this update as "extremely high."
Google stated in its announcement that access to details about the vulnerability and related links may remain restricted until most users have completed their updates. The company recommends users manually check for and trigger updates via "Settings → About Chrome," and restart the browser after updating to apply the patch. For users still running versions prior to Chrome 157.0.8103.50, the immediate priority is to verify their version number and restart the browser to complete the upgrade.