Google has released a security update for Chrome that addresses nine vulnerabilities, including a zero-day exploit currently being used in the wild.
The update, which began rolling out on November 9, 2026, brings the browser to versions 157.0.8103.50 and 157.0.8103.51 for Windows and Mac, and 157.0.8103.50 for Linux. The most critical flaw, tracked as CVE-2026-125350, is a use-after-free vulnerability located in the browser’s XML component.
This security flaw was reported anonymously to Google on November 6, 2026. A use-after-free bug occurs when software continues to reference a memory address after the application has released that memory, potentially allowing an attacker to corrupt memory, cause a browser crash, or execute arbitrary code.
Chrome Vulnerabilities Allow Remote Code Execution Through Crafted Pages
The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox by persuading a user to visit a crafted HTML page. Beyond the zero-day, the update also resolves eight other security issues, including high-severity flaws in the FileSystem, Compositing, GPU, and WebGL components, alongside type confusion issues in the V8 JavaScript engine.
These vulnerabilities exist in Google Chrome due to use after free in XML, type confusion in V8, out-of-bounds write in GPU, incorrect authorization in FileSystem, buffer overflow in Compositing, and uninitialized resource bugs in WebGL and GPU.
The Indian Computer Emergency Response Team (CERT-In)
The vulnerability is the eighth actively exploited Chrome zero-day discovered in 2026. This year’s list of exploited zero-days includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. Because of the high severity, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog, with a requirement for federal agencies to apply the patch by November 24, 2026.
CERT-In and HKCERT Advise Immediate Patching of Exploited Flaws
India’s CERT-In agency rated the vulnerabilities as critical in its November 10, 2026, advisory, identified as CIVN-2026-0544. The agency warned of a high “risk of arbitrary code execution and compromise of affected systems” and advised users to apply the latest patches immediately. Hong Kong’s Computer Emergency Response Team Coordination Centre (HKCERT) has categorized the overall risk level as “Extremely High.”
“This vulnerability (CVE-2026-125350) is being actively exploited in the wild. Users are strongly advised to apply the latest patches immediately,” CERT-In said in its official note.
Users of Chromium-based browsers, including Microsoft Edge, Opera, Brave, and Vivaldi, are also advised to monitor for updates as they become available, as these platforms are also affected by the underlying flaws.
Google said that it restricts the release of technical bug details to prevent further exploitation until a majority of the user base has successfully applied the fix.
“Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” the company said. “We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on, but haven’t yet fixed.”