Dev.to Security 🔐 Cybersecurity Sun, 15 Nov 2026 18:28:27 +0000 👁 0 📖 5 min read

Chrome Zero-Day CVE-2026-125350: How to Update Chrome and 6 Checks for Extension Developers

Updating your own Chrome takes a minute. The part that takes longer is every other Chrome you forgot you have. None of this is a reason to ship anything in a hurry. You read the headline between two tasks. Another Googl

Updating your own Chrome takes a minute. The part that takes longer is every other Chrome you forgot you have. None of this is a reason to ship anything in a hurry.

You read the headline between two tasks. Another Google Chrome zero-day, already used in attacks. You open the menu, see a small "Relaunch" button, think "later", and go back to your code. The laptop stays open for the rest of the week.

CVE-2026-125350 is a high-severity Chrome vulnerability: a memory bug (a "use-after-free") in the part of Chrome that reads XML. Google fixed it with a Chrome security update on 9 November 2026, in Chrome 157.0.8103.50 for Linux and 157.0.8103.50/.51 for Windows and Mac, and wrote one short line about it: an exploit for this bug exists in the wild. The security press counts it as the eighth Chrome zero-day used in attacks this year.

A smaller question helps more than the headline: how many copies of Chrome do you really run? For an extension developer the answer is rarely one. Go through the list in order. The first four are checks for today; the last two are for the rest of the week.

1. Check your Chrome version

"I have auto-update" is a setting, not a version number. If you are asking "what version of Chrome do I have?", open this page and read the number:

chrome://settings/help

On Linux the terminal shows the installed build (the running one may still be older until you restart):

google-chrome --version

There is one more detail. On 11 November Google shipped a second update, 157.0.8103.78 (.79 on some Windows and Mac machines), with 83 more security fixes, five of them rated Critical. So the fix for the zero-day is in .50, but the latest Chrome version at the time of writing is .78, and that is the number you want to see.

2. Update Chrome, then relaunch it

How to update Chrome: open Help → About Google Chrome and wait for the download to finish. On Windows and Mac, Chrome usually does this by itself in the background; on Linux the update arrives with your system updates. It starts using it only after a restart. A downloaded update protects nobody while the old browser is still running.

Developers are a bad case here. We keep one window open for days, with forty tabs. Picture a freelance developer whose Chrome downloaded the update on Monday. They never closed the window, so on Friday they are still on the old build. Click "Relaunch".

3. Count the other Chromes on your machine

This is the step that took me the longest. On my work machine I found more browsers than I expected:

Chrome Beta and Canary, which I use to test upcoming changes
an old portable copy in a folder for reproducing bug reports
the browser that my test tool downloaded for itself

The last one is easy to forget. Automation tools such as Playwright and Puppeteer download their own browser build. It does not update with your Chrome. It changes only when you update the tool.

This part is a guess: I have not seen an official statement about these builds and this bug. They are built from the same code, so I treat an old one as unpatched. Check which browser version the tool ships, update the tool when a release with 157.0.8103.50 or later is out, and until then do not use that browser to open pages you do not control.

4. Check the other browsers your extension lives in

If you publish in more than one store, you also run more than one browser. Each of them ships the fix on its own schedule.

Edge. Microsoft's release notes say Edge 157.0.4341.46, released on 9 November, contains the fix.
Brave, Opera, Vivaldi. I did not find a clear statement for each of them, so I give no version numbers here. Open the "About" page in each browser and read the vendor's release notes.

Firefox uses a different engine. I found no report that it is affected.

5. Watch your store numbers for a week, and do not ship in a panic

Google describes it as a bug in the browser itself. Nothing I read says extension code needs to change because of it. An emergency release "just in case" brings more risk than it removes.

What I do instead is boring. Three Chrome builds shipped in just over a week, and any browser update can change how an extension behaves. The first sign is rarely a bug report. It is a new one-star review or a rating that starts to slip. I open my extensions in cwspy.com every morning anyway; this week I read the rating and review lines more carefully. Each release and listing edit is marked on the same line, so if something bends, I can see whether it sits next to my change or next to nothing of mine.

6. Tell your users one calm sentence

If you have a newsletter, a changelog or a support inbox, one sentence is enough: "Chrome has an important security update, please open Help → About Google Chrome and relaunch." No drama, no promise that your extension protects anyone. An extension cannot fix a browser bug.

What we know about the Chrome zero-day, and what we do not

Fixed in: Chrome 157.0.8103.50 (Linux) and .50/.51 (Windows, Mac), released 9 November 2026. A second update, 157.0.8103.78/.79, followed on 11 November.
Reported: first on 12 October and again on 6 November, according to Google's release note.
Exploited: Google says an exploit exists in the wild. According to press reports, CISA added the bug to its list of known exploited vulnerabilities on 10 November, with a 24 November deadline for US federal agencies.
Not public: who uses it, against whom, and how. Google usually keeps the details restricted until most users have updated.
Extensions: nothing I read connects this bug to extensions.

The short version

Check your Chrome version. You want 157.0.8103.78 or later.
Update Chrome and relaunch it.
Update Beta, Canary and portable copies, and check the browser inside your test tools.
Check Edge and the other browsers you publish for.
Do not ship an emergency release; watch your rating and reviews for a week.
Tell users to update, in one sentence.

A security headline asks you to be worried. A version number asks you to check. The second one takes a minute.

Sources:

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home