Chrome Zero-Day CVE-2026-125350: How to Update Chrome and Edge Today

If you opened Chrome this week, there is a good chance it is still running a build from before Monday. Google shipped a fix on November 9 for a bug that attackers were already using, and the update reaches people gradually, so it is worth checking by hand. The whole check takes about two minutes.

This guide explains what the Chrome zero-day CVE-2026-125350 is, which versions carry the fix, and what a small team can do about it today.

What happened

CVE-2026-125350 is a use-after-free bug in the XML component of Chrome. Google rates it High and says it is aware that an exploit exists in the wild. An anonymous researcher reported it on November 6, and the fix arrived in the Stable channel on November 9, three days later.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 10. Its entry describes a specially crafted web page that could let an attacker run code inside the browser sandbox. Google has not shared who was targeted or how, which is normal while people are still updating.

The same release fixed nine security issues in total. One of them, CVE-2026-125346, is also an XML use-after-free, but Google has only said that CVE-2026-125350 is exploited. Industry commentators count it as Chrome's eighth zero-day of 2026.

Which versions have the fix

Chrome 157 reached Stable on November 3. Builds from that first release do not include this fix. You want one of these or newer:

• Windows and macOS: 157.0.8103.50/.51
• Linux: 157.0.8103.50
• Android: 157.0.8103.50
• Extended Stable (Windows and macOS): 156.0.8078.96

At the time of writing, ChromeOS had no Stable update listing this fix, so Chromebook users should keep checking their update page.

What to do: update Chrome in four steps

1. Open Chrome and go to the three-dot menu, then Help, then About Google Chrome.
2. Let it download the update. The page shows your version number.
3. Click Relaunch. The patch does not apply until the browser restarts.
4. Open About Google Chrome once more and confirm the number matches the list above or is higher.

Keep your tabs in mind before relaunching. Chrome offers to restore them, so you will not lose your place.

What to do: Edge, Opera, Brave and others

Because the bug lives in Chromium, other browsers built on it can be affected too. Microsoft Edge receives the fix through its own update, so open edge://settings/help, let it check, and restart. I could not find a confirmed Edge version number in the sources, so rather than quote one, I suggest checking that Edge reports it is up to date.

Opera, Brave and Vivaldi publish their own builds. Check each vendor's release notes, and update as soon as a build that lists the Chromium fix appears.

What to do for a small business or website team

Browsers are easy to forget because they update themselves. A few habits make this routine:

• Ask everyone on the team to open the About page and relaunch today.
• If you manage company laptops, push the new version through your device management tool and set a short deadline for the restart.
• Remind people who keep Chrome open for weeks that the restart is the step that counts.
• Check any kiosk, reception or shared computers, which often miss updates.
• If you run a website, nothing needs changing on your server for this one. It is a visitor-side issue, so the useful step is making sure your own team is covered.

A wider trend worth noting

This was not the only exploited bug added to the CISA list on November 10. A Microsoft Outlook flaw, CVE-2026-124194, that can expose NTLM hashes was added the same day, and Microsoft fixed it in its November Patch Tuesday release. The pattern is the same each time: a fix exists, and the gap is the time between release and installation.

For a small team, the simplest defence is a short, regular routine. Pick one day a week to confirm browsers, operating systems and plugins are current, and treat any "exploited in the wild" headline as a reason to do it sooner.

Quick checklist

• Chrome shows 157.0.8103.50 or newer (Linux and Android), or 157.0.8103.50/.51 or newer (Windows and macOS)
• Browser has been relaunched after the update
• Edge reports it is up to date
• Other Chromium browsers checked against their vendor notes
• Team members and shared computers covered
• A weekly update check is on the calendar

Closing

Updates like this one are a reminder that the quickest security win is often the plainest one. If you would like a second pair of eyes on your website or your team's setup, the free health check and care plans at expertwebdeveloper.in are a friendly place to start, and more practical guides live at growsmartwithai.com.

This guide is also available on expertwebdeveloper.in, Medium, Substack and LinkedIn.

Sources

• Google Chrome Releases, Stable Channel Update for Desktop, November 9, 2026 (summarised by Rescana and SmartScope)
• CISA: Adds Six Known Exploited Vulnerabilities to Catalog, November 10, 2026
• SOCRadar: CVE-2026-125350, Google Fixes Exploited Chrome XML Zero-Day
• CSO Online: November 2026 Patch Tuesday
• Chrome Geek: Update Chrome Now