Published 13 November 2026 · Rathish Kumar, Invitty

On 9 November 2026 Google released Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux to fix CVE-2026-125350, a use-after-free in Chrome's XML code that Google says is already being exploited. Any desktop below that build is exposed, as is Extended Stable below 156.0.8078.96. Update every PC, then make sure each browser has actually restarted.

What Google fixed, and why this one cannot wait for the monthly cycle

The 9 November Stable update carried nine security fixes. One of them, CVE-2026-125350, is rated High and sits in the XML component. Google's release note credits two separate reports: one from Arni Hardarson of Neonix Security on 12 October, and an anonymous one on 6 November. It then adds the line every admin should look for, that Google knows an exploit for this bug exists in the wild.

Two government bodies followed within a day. CISA put the bug in its Known Exploited Vulnerabilities catalog on 10 November with a remediation date of 24 November for US federal agencies, and describes it as letting a remote attacker run code inside the browser sandbox through a crafted web page. In India, CERT-In issued vulnerability note CIVN-2026-0544 the same day and rated it Critical. A malicious page is enough. Nobody has to download or open a file.

Then, on 11 November, Google pushed another Stable build, 157.0.8103.78/.79, with 83 security fixes, five of them Critical (use-after-free bugs in ServiceWorker, CSS, Layout, Skia and Accessibility). None of those is marked as exploited. Still, our advice is simple: do not stop at .50. Aim every desktop at .78 or later and you close both batches in one restart.

Which browser builds are safe?

Fixed builds for CVE-2026-125350, as listed on 13 November 2026Scroll to see all columns →
Browser and channelFirst build with the fixNewer build to target
Chrome Stable, Windows and Mac157.0.8103.50/.51 (9 Nov)157.0.8103.78/.79 (11 Nov)
Chrome Stable, Linux157.0.8103.50 (9 Nov)157.0.8103.78 (11 Nov)
Chrome Extended Stable, Windows and Mac156.0.8078.96 (9 Nov)156.0.8078.100 (11 Nov)
Microsoft Edge for Android157.0.4341.53 (11 Nov)Same
Microsoft Edge desktop StableNot yet listed by MicrosoftWatch the Edge security notes

The Edge row is the one that worries us. CISA notes that the flaw can affect other Chromium-based browsers, naming Edge and Opera. Microsoft's Edge security release notes say on 9 November that it knows about the exploits and is working on a fix, and on 11 November they list an Edge for Android build with the fix. When we checked on 13 November, no Edge desktop build was named. Edge 157.0.4341.42, released on 5 November, came out before Google's fix.

Why "Chrome updates itself" is not enough in an office

Chrome downloads updates quietly, but the new code only runs after the browser restarts. In the audits we run, the PCs still on old builds are rarely broken; they belong to people who never close Chrome. Finance teams with a GST portal, a bank tab and thirty others open are the classic case, and they are also the people an attacker would most like to reach.

To check one machine, open chrome://settings/help. It shows the version, fetches any pending update and offers a Relaunch button. To check a hundred machines, you need central management. If you run Google Workspace, the Admin console can enrol Chrome browsers and show the version on each one, and the RelaunchNotification and RelaunchNotificationPeriod policies can make the restart mandatory after a set number of hours. On Windows domains the same policies can go out through Group Policy or Intune.

What to do this week, in order

  1. List your browsers. Chrome, Edge and any other Chromium browser people installed themselves. Note shared PCs, kiosks and VDI images separately, because nobody signs in to update them.
  2. Push Chrome to 157.0.8103.78 or later (or 156.0.8078.100 on Extended Stable) and set a forced relaunch window of 24 to 48 hours.
  3. Rebuild golden images. A VDI or imaging template with an old Chrome puts the bug back on every new machine.
  4. Track Edge daily. Install Microsoft's desktop fix the day it appears in the security release notes. Until then, keep a close eye on high-risk users such as finance and IT admins, and make sure their Chrome is current.
  5. Check Chromebooks. The ChromeOS Stable release of 6 November ships browser 156.0.8078.93 and does not list this CVE. Watch the Admin console for a newer ChromeOS build and push it.
  6. Look at your endpoint alerts. If your EDR has flagged a browser spawning odd processes or writing executables since early November, treat it as a possible incident, not noise.

What this means for Indian businesses

CERT-In's note covers every organisation running Chrome below the fixed builds, which in practice means nearly every office we visit. If you find signs that a PC was compromised through the browser, remember that CERT-In's April 2022 directions expect certain incidents to be reported within six hours of noticing them, so decide now who makes that call.

There is also a budget point. Browser patching is free, but seeing which machines are behind is not automatic. If you are on Google Workspace, start with the browser management you already pay for. If you run a mixed fleet, an endpoint security or device management tool that reports application versions turns a week of desk visits into a single report.

Questions IT teams are asking about the Chrome zero-day

Is Microsoft Edge affected by CVE-2026-125350?
CISA says the flaw can affect other Chromium-based browsers, including Edge and Opera. Microsoft said on 9 November that it was working on a fix and listed an Edge for Android build with the fix on 11 November. As of 13 November no Edge desktop build was named, so check Microsoft's Edge security release notes daily and update as soon as it appears.
How do I check which Chrome version a PC is running?
Open chrome://settings/help, or go to the three-dot menu, then Help, then About Google Chrome. The page shows the version, downloads any pending update and offers a Relaunch button. You want 157.0.8103.50 or later, and ideally 157.0.8103.78 or later.
We updated on 9 November. Do we need to update again?
Yes. Google released 157.0.8103.78 on 11 November with 83 more security fixes, five of them rated Critical. None of those is marked as exploited, but one more restart closes them all.
Are Chromebooks covered by the Chrome update?
Not automatically. ChromeOS has its own release train, and the Stable ChromeOS update of 6 November ships browser 156.0.8078.93 without listing this CVE. Check the Admin console for a newer ChromeOS build and push it to your devices.

Next step

Send us a rough count of PCs and which browsers they run, and tell us whether you use Google Workspace, Microsoft 365 or neither. We will suggest the quickest way to see every browser version, help switch on forced relaunch, and flag machines that are too old to take current builds. More on what we deploy is on our Google brand page.

Sources

Facts in this post come from these pages, checked on the date of publication. Advisories and release notes change, so check the source before you schedule work.