Google Patches Chrome Zero-Day and Eight Other Flaws in Security Update

Google released a Chrome update Nov. 9 that fixes a zero-day flaw already exploited in attacks, giving U.S. users a patch for a high-severity bug in the browser’s XML component.

The flaw, CVE-2026-125350, is a use-after-free error, in which software accesses memory after it has been released. Google rated it high severity. The release did not identify an attack method, victims or an attacker.

The stable desktop update takes Windows and Mac to versions 157.0.8103.50 or 157.0.8103.51, and Linux to 157.0.8103.50. Google is distributing the release in stages over the coming days and weeks, so availability may vary by user.

The full patch addresses nine vulnerabilities: seven rated high and two rated medium. A separate XML use-after-free vulnerability, CVE-2026-125346, was also included. Google issued Chrome 157.0.8103.50 for Android on Nov. 9, with Google Play availability expected over the following days. Android’s security fixes match the desktop version unless otherwise noted.