Chrome patches its eighth exploited zero-day of 2026—your tabs can wait

Counts from X are delayed. They’ll show here once X sends them.

Counts from X are delayed. They’ll show here once X sends them.

Check the update, not just the restart

The outlets list these patched Stable Desktop versions: Source Source

• Windows and macOS: 157.0.8103.50 or 157.0.8103.51
• Linux: 157.0.8103.50

To check manually, open Chrome’s Settings and select About Chrome. Google says the rollout will take days or weeks, according to the reports. BleepingComputer found the update available during its November 10 check. Source Source

BleepingComputer notes that automatic updates install after the next launch. Install the update when it’s available, then relaunch. A relaunch isn’t a magic delivery service for a patch that hasn’t arrived. Source Source

The XML flaw and eight other fixes

The Register describes CVE-2026-125350 as a high-severity use-after-free vulnerability in Chrome’s XML component. That means software continues referencing memory after it has been freed. Such bugs can allow attackers to corrupt memory and execute malicious code, but Google hasn’t disclosed how this particular flaw is being exploited. Source

Google also hasn’t identified the attackers or their targets, according to The Register. BleepingComputer reproduces Google’s warning that access to bug details may remain restricted until a majority of users have installed a fix. Source Source

The release fixes eight additional vulnerabilities, The Register reports. That’s nine security fixes—not nine known exploited zero-days. Source

With this patch, Chrome’s 2026 tally matches the eight actively exploited zero-days fixed in all of 2025, according to both outlets. An unwanted tie, with weeks still left in the year. Source Source