Chrome: eighth zero-day of 2026 (CVE-2026-125350)

Published on November 10, 2026 · The mitza.es team

The browser is the application that stays open the longest in any office and the one that runs the most third-party content. That is why every time Google fixes a flaw that is already being exploited, it is worth checking it the same day. We summarize what is known as of November 10, 2026 and, at the end, how to update Chrome step by step.

What happened

November 9, 2026: Google releases an update to the Chrome stable channel for desktop (it appears with that date on its official release blog, Chrome Releases).
Nine vulnerabilities fixed, according to SecurityWeek's analysis, one of them an exploited zero-day: CVE-2026-125350, a high-severity use-after-free flaw (use of memory that has already been freed) in the browser's XML component.
Reported on November 6 by an anonymous researcher, according to SecurityWeek. Three days later there was a patch.
It is the eighth Chrome zero-day of 2026. The previous one we covered was the September one (CVE-2026-85046), the sixth of the year.

Several sources agree on the essentials: the SANS ISC bulletin of November 10 and The Hacker News headline point to the same identifier, the same XML component and the fact that the flaw is being exploited. What has not been published is the detail: Google has not explained how it is exploited or who is being targeted, and as this article went to press we had not seen the flaw in the Known Exploited Vulnerabilities (KEV) catalog of the US agency CISA. The specific versions we cite below come from SecurityWeek; we could not read the full text of Google's note while preparing this article.

What “use-after-free” means in plain language

When a program finishes using a piece of memory, it “frees” it so it can be reused. In a use-after-free, the program keeps using that area after freeing it, and an attacker who manages to place their own data there can divert the browser's behavior. It is one of the most common families of bugs in browsers. With flaws of this kind, it is often enough to visit a page prepared for the purpose, without downloading or opening anything, but for this specific case there are no public technical details that confirm it or that allow us to say more.

Which version you need

According to SecurityWeek, the fixed versions are 157.0.8103.50 and .51 for Windows and macOS and 157.0.8103.50 for Linux. The practical rule is the same as always: the installed version must be equal to or higher than the one Google gives for your system. The same batch also fixes six high-severity flaws in WebGL, FileSystem, Compositing, GPU, V8 and XML, and two medium-severity ones in GPU.

How to update Chrome step by step

On Windows and macOS

Open Chrome and click the three-dot menu at the top right.
Go to Help → About Google Chrome (you can also type chrome://settings/help in the address bar).
Chrome checks for a new version and downloads it by itself. You'll see the version number on that screen.
Click Relaunch when the button appears. Until you restart, the browser keeps running the old version, even if the new one has already been downloaded.
Open the same screen again and check that the version number is equal to or higher than the one given and that it says Chrome is up to date.

On Linux

Chrome is updated with your distribution's package manager (for example apt or dnf), if you installed it from Google's official repository. Update the package and restart the browser.

On mobile

The notes we have reviewed talk about the desktop version. Even so, it is a good habit to open Google Play or the App Store and check that Chrome has no pending update.

If “the update doesn't show up”

Check that you have a connection and open the About Google Chrome screen again.
If the computer belongs to your company, updates may be managed by an administrator through policies and the button may not appear: ask them to confirm the version.
If Chrome has been open for weeks without restarting (very common with dozens of tabs), restart it: it is the most frequent reason a downloaded patch has not been applied.
If the update fails, uninstall Chrome and install the latest version from Google's official website.

Edge, Brave, Opera and other browsers

Many browsers are based on Chromium, the project Chrome comes from, and they receive fixes on their own schedule. We have not been able to confirm in which version of each one this fix arrives, so the prudent thing is to open their update screen and apply whatever they offer. The advisory we have reviewed is for Chrome; browsers that don't use Chromium have their own advisories.

If you manage a company's computers

Take an inventory of which browsers and versions are in use, including laptops that connect only now and then.
Define an update policy that forces the browser to restart after a reasonable period following each critical update.
Mark zero-days as urgent: a flaw that is already being exploited is not a task for the next maintenance window. Here is a guide to reading advisories and setting deadlines.
Review the installed extensions and remove the ones that aren't used: they are another way in.
Train your staff not to open dubious links: many attacks start with a fake message, such as the fake SMS messages from the DGT, Correos or the tax agency or the forged QR codes.

Quick questions

If I have automatic updates, am I protected?

Chrome downloads updates in the background, but the patch is only applied when you restart the browser. If you leave it open for days, you may be running a vulnerable version.

Do I have to switch browsers?

No. All browsers fix serious flaws regularly; what makes the difference is updating them quickly. Eight zero-days in a year may seem like a lot, but what matters is that each one is fixed as soon as Google has the patch.

Can I keep using Chrome while I update?

Yes. When it restarts, Chrome usually restores the tabs you had open. Save anything you have half-finished in web forms first.

How we can help at Mitza

We take an inventory of your company's software, apply critical updates and define a simple policy so it doesn't depend on each person remembering. See how we approach it in our IT maintenance for small businesses or tell us about your case on the contact page.

Chrome fixes its eighth zero-day of 2026 (CVE-2026-125350): how to update and check you are protected