Google Chrome Update Fixes 8th Exploited Zero-Day of 2026: Update Now
Someone drops a link in a WhatsApp group about a "special offer" or a breaking story. You tap it and an ordinary-looking page loads. No download, no strange pop-up. Yet if your browser is out of date, that page alone may be able to run malicious code inside it. That is the kind of risk that pushed Google to ship an emergency Chrome update on 9 November 2026 to close a zero-day attackers are already exploiting.
In short: Google has fixed an actively exploited Chrome flaw, CVE-2026-125350, a use-after-free bug in the XML component. The fix ships in version 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux and Android. It is the eighth exploited Chrome zero-day of 2026, and the fix is simple: update your browser and restart it now.
What is the new Chrome flaw, CVE-2026-125350?
According to Google's official Chrome Releases blog, the flaw is rated High and described as a "use after free in XML". Put simply, the browser tries to use a piece of memory after it has already released it. An attacker can sometimes place data of their choosing in that spot and steer the browser into running it.
Google wrote that it is aware an exploit for the bug exists "in the wild", meaning in real attacks rather than a lab. It credits researcher Arni Hardarson of Neonix Security, who reported it on 12 October, and an anonymous reporter on 6 November. Google has not shared details about the attacks or who is behind them, which is its usual practice until most users have updated.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog on 10 November. It says the bug could let a remote attacker execute code inside the browser sandbox through a specially crafted web page, and warns that it could affect other Chromium-based browsers, including Edge and Opera. US federal agencies have until 24 November 2026 to fix it.
If you want a quick primer on the term itself, see our explainer on what a zero-day attack is.
Why the eighth Chrome zero-day of the year matters
BleepingComputer counts seven earlier exploited Chrome zero-days in 2026, between February and September, most of them in V8, the engine that runs JavaScript. The new one takes the total to eight, with weeks of the year still to go.
The practical takeaway is that the browser has become one of the main ways into your device. A booby-trapped page does not always need you to download a file or click a button; sometimes opening it in an old version is enough. That is what makes fake links and poisoned search results so dangerous, as we saw with the Armorsteal malware spread through fake search results.
Which Chrome version is safe?
The fix first shipped in the versions below, and anything higher includes it too:
| Platform | First version with the fix |
|---|---|
| Windows and Mac | 157.0.8103.50 or 157.0.8103.51 |
| Linux | 157.0.8103.50 |
| Android | 157.0.8103.50 |
| Extended Stable channel | 156.0.8078.96 |
Just two days later, on 11 November, Google released a newer build, 157.0.8103.78/.79 for Windows and Mac, with 83 additional security fixes, followed by 157.0.8103.78 for Android. If you see that number, you are in even better shape.
How to update Google Chrome on a computer
- Open Chrome and click the three dots at the top right.
- Choose Help, then About Google Chrome.
- Chrome checks for the update and downloads it automatically.
- Click Relaunch. Your open tabs come back as they were.
You can also type chrome://settings/help in the address bar to reach the same page, which shows your current version. One important detail: Chrome downloads updates in the background but does not apply them until you restart. Plenty of people leave the browser open for weeks and stay on the old version even though the update is waiting.
How to update Chrome on your phone
On Android
- Open the Google Play Store and tap your profile picture.
- Choose Manage apps & device, then Updates available.
- Update Google Chrome, or search for it in the store and tap Update.
- To check the version, open Chrome, go to Settings, then About Chrome.
Google notes that the Android build reaches Google Play over a few days, so if the update is not there today, check again tomorrow.
On iPhone
Update Chrome from the App Store as usual. Google's note for the latest iOS release does not mention this flaw, and Chrome on iPhone runs on Apple's WebKit engine. Keeping both the app and iOS itself updated is still a good habit.
What about Edge, Opera and Brave?
These browsers are built on Chromium and usually receive its fixes shortly after Chrome. On its Edge security release notes page, Microsoft said on 9 November that it was aware of the exploit and working on a fix. On 11 November it shipped Edge for Android 157.0.4341.53 with the fix included. We have not yet found official confirmation of a fixed release for Opera or Brave, so check for updates manually over the next few days.
- Edge: three dots, then Help and feedback, then About Microsoft Edge, or type edge://settings/help.
- Opera: type opera://update in the address bar, or open the menu and choose Update & Recovery.
- Brave: menu, then About Brave, or type brave://settings/help.
- On phones: update the browser from Google Play or the App Store.
FAQ
How do I check my Google Chrome version?
Type chrome://settings/help in the address bar on a computer, or open Settings and then About Chrome on your phone. The number should be 157.0.8103.50 or higher.
Does Chrome update automatically?
Yes, it downloads updates on its own, but it needs a restart to apply them. Google also says the rollout can take days or weeks to reach everyone, so it is better to check manually.
Does the Chrome flaw affect Microsoft Edge?
According to CISA, it could affect Chromium-based browsers, Edge included. Update Edge as soon as the fixed version reaches your device.
Do I need extra security software?
Security software helps, but it is no substitute for updating. If your phone starts acting strangely after you open a suspicious link, see our guide on how to tell if your phone is hacked.
Bottom line
CVE-2026-125350 is being exploited right now, and a single web page is enough to abuse it in an unpatched browser. Take one minute: open About Google Chrome, make sure the number is 157.0.8103.50 or higher, then relaunch. Do the same for Edge and any other browser you use, on both your computer and your phone.
Sources: Google Chrome Releases blog, CISA (Known Exploited Vulnerabilities catalog), Microsoft Edge security release notes, BleepingComputer.
Because an up-to-date browser is the first line of defense against booby-trapped links, our interest extends from following Arabic websites and specialized blogs, to what Egypt stores, Kuwait stores, vitamin stores and international sites offer, with Mashhor for social media services as a key to growth.
That's it, friends. We hope you found this useful โ
Best wishes from the #Ezznology team.
Join our community on Telegram and our Facebook group, and follow us on Google News.
You may also like:
Armorsteal: Malware Spreading Through Fake Google Search Results
How to Know If Your Phone Is Hacked: 10 Signs and Fixes
Windows Update October 2026: 1,411 Flaws and an Exploited Zero-Day
