Google has pushed a Chrome update to fix a high-severity flaw that attackers are already using. If you have not restarted your browser since Monday, do it now: the patch only takes effect after a relaunch.
The bug is tracked as CVE-2026-125350, a use-after-free in Chrome’s XML handling. Google’s release note says only that it is aware an exploit for the flaw exists in the wild. It has not said who is using it, whom they are targeting, or how the attack works, and it keeps bug details locked until most people have updated.
A use-after-free means the browser keeps using a piece of memory after it has been released. Inside a browser, a rigged page can abuse that to take over what the tab does. The usual route is a link in a phishing message, an ad or a hacked site, so the sensible assumption is that opening the wrong page is enough.
Google’s Stable channel post names the fixed builds: 157.0.8103.50 on Linux, and either that or a .51 build on Windows and Mac. It says the rollout takes days to weeks. Chrome on Android moved to 157.0.8103.50 as well, and Google says Android builds carry the same security fixes as the matching desktop release. Google’s Android note adds that the build reaches Google Play over the next few days.
Someone who did not give a name sent Google the report on 6 November, and the patch followed on 9 November.
Google’s changelog lists nine security patches, seven of them High severity and the other two Medium. Besides the XML bug, the High-rated ones cover another XML memory bug found by Arni Hardarson of Neonix Security (CVE-2026-125346), a type confusion in the V8 JavaScript engine, a buffer overflow in compositing, an out-of-bounds write in the GPU code, an uninitialised resource in WebGL and incorrect authorisation in the FileSystem component. Google’s own team found most of them. The two Medium fixes are both uninitialised-resource bugs in the GPU code.
To check your copy, open the menu, go to Help, then About Google Chrome. Chrome downloads the update in the background and shows a Relaunch button when it is ready. On Linux, update through your package manager. Browsers built on the same Chromium engine usually need their own patches, so Edge, Brave and others may lag behind by a few days; check their update pages too.
Google has not said whether the attacks have stopped or how widespread they were. Details of the bug should appear once most users have the fix.
