Google Patches an Exploited Chrome XML Flaw
Google has started rolling out desktop Chrome fixes for a high-severity use-after-free flaw in the browser’s XML component. Google says an exploit exists in the wild. The stable release includes nine security fixes. The exploited flaw makes it urgent to check for browsers that have downloaded an update and are still running the previous build. CVE-2026-125350 · Google’s Stable advisory
Match the build to the channel
Google lists Stable 157.0.8103.50 or .51 for Windows and macOS and 157.0.8103.50 for Linux. On Windows and macOS, Extended Stable 156.0.8078.96 also includes the XML fix. Relaunch Chrome and verify the installed build in the running browser. For Edge, Opera or another Chromium-based browser, use that supplier’s advisory and fixed build. Google’s Stable advisory · Google’s Extended Stable advisory
Update, 10 November 2026
CISA added the flaw to its Known Exploited Vulnerabilities catalogue and set a 24 November deadline for covered US federal agencies. The catalogue describes code execution inside the browser sandbox after processing a crafted page. The listing gives no evidence of a separate sandbox escape in this case. CISA catalogue
Update, 11 November 2026
Google began rolling out Extended Stable 156.0.8078.100 for Windows and macOS. It supersedes the 9 November build on that channel. Google’s 11 November release notice
