Google has released an emergency update for its Chrome browser to fix a security flaw that attackers are already using. If you browse on a laptop, desktop or Android phone, check your browser version today. The fix is part of Chrome 157, and security sites SecurityWeek and The Register both report that this is the eighth Chrome zero-day exploited in the wild in 2026.
What the flaw is
The bug is tracked as CVE-2026-125350 and rated high severity. It is a "use-after-free" problem in Chrome's XML component. In plain words, the browser keeps using a piece of memory after it has already been released. According to Techlicious, that can let an attacker crash the program or, in some cases, run their own code on the device.
An anonymous researcher reported the flaw to Google on 6 November, and a patch was ready three days later. Google said in its advisory, published on Monday, that it is aware an exploit exists in the wild. The company has not said who is behind the attacks, who was targeted, how the exploit reaches a victim or how many people were affected. As The Register notes, Google usually holds back details until most users have updated, so more may come out in the next few days. Nothing in the advisory points to a mass campaign, but there is no reason to wait.
Which version to look for
The fixed builds are 157.0.8103.50 or 157.0.8103.51 on Windows and Mac, and 157.0.8103.50 on Linux. On Android, Google released Chrome 157.0.8103.50 and says it will reach the Play Store over the next few days. Google also says the rollout can take days or weeks to reach everyone, so keep checking if the update has not shown up.
The same Chrome 157 update repairs eight other flaws, including high-severity bugs in WebGL, FileSystem, GPU, Compositing and the V8 JavaScript engine, according to SecurityWeek and The Register. The Register adds that a second XML use-after-free bug, CVE-2026-125346, was fixed too, but Google has not said it is being exploited.
How to update Chrome in a minute
- Open Chrome and click the three-dot menu at the top right.
- Go to Help, then About Google Chrome.
- Chrome will check for the update and download it.
- Click Relaunch. The patch only works after the browser restarts.
On an Android phone, open the Play Store, search for Chrome and tap Update if it is shown. If it is not shown yet, check again in a day or two.
Other browsers are affected too
Chrome is not the only browser built on the same underlying Chromium code. Techlicious reports that Vivaldi released patched desktop and Android versions dated 10 November. At the time of its report, patched releases for Microsoft Edge, Brave and Opera were not confirmed. If you use one of them, run the built-in update check and install whatever it finds. Many Indian users run Edge on office laptops and Brave on phones, so it is worth opening the About page of whichever browser you use.
Microsoft also patched an Outlook zero-day
The Chrome fix landed on the same day as Microsoft's monthly security update. BleepingComputer reports that the November Patch Tuesday fixed a record 1,235 flaws, including one Outlook spoofing zero-day (CVE-2026-124194) that was being exploited. Microsoft says an attacker could send a specially crafted message file, and if a user opens it, Outlook could connect to an attacker-controlled network location without the usual external-content warning. That can expose login information that might later be used to impersonate the user. It needs the user to open the file, so the basic rule applies: do not open unexpected attachments, even from familiar-looking senders.
What to do now
- Update Chrome, Edge, Brave or any Chromium-based browser and restart it.
- Install pending Windows and Office updates.
- Avoid opening unknown attachments and clicking links in unexpected messages, especially ones that claim to be from banks, couriers or government offices.
- Keep automatic updates switched on.
What next
Google is expected to publish more technical detail once enough users have updated. Until then, the safest step is to update now. We will add any official statement about who was targeted if Google or the other vendors release it.
