Google has patched another Chrome security flaw that attackers are already using, the eighth of 2026. The fix arrived on Monday 9 November (US time; Tuesday in Australia) in Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, and in Chrome 157.0.8103.50 for Android. The update rolls out over “days/weeks”, so the safest move is to check your version yourself rather than wait.
There is a catch for anyone who thinks they are already up to date: Chrome 157 first reached desktops on 3 November as version 157.0.8103.38/.39. Those earlier 157 builds don’t carry this fix. And because the bug sits in Chromium, the open-source code behind Edge, Brave, Opera and Vivaldi as well as Chrome, those browsers need patching too. As of Wednesday 11 November, Microsoft Edge was still waiting for its fix.
What Google has confirmed
According to Google’s Chrome release notes, the update contains nine security fixes: seven rated high and two medium. The one that matters most is CVE-2026-125350, a high-severity “use after free” bug in Chrome’s XML component, reported anonymously on 6 November. Google’s only statement about attacks is that it “is aware that an exploit for CVE-2026-125350 exists in the wild”.
That is all Google has said. It hasn’t named who is using the flaw, who has been targeted, how the attack is delivered or what it achieves, and it keeps bug details restricted “until a majority of users are updated with a fix”. SecurityWeek and Malwarebytes both note that no further information about the attacks is available. SecurityWeek counts it as the eighth exploited Chrome zero-day of the year; The Tech Boom covered the September one, CVE-2026-85046.
A use-after-free bug happens when a program keeps using a piece of memory after it has handed it back. Attackers can sometimes use that to crash the browser or run their own code. The US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities catalog on 10 November, describes it as letting a remote attacker “execute arbitrary code inside the sandbox via a specially crafted webpage”. In other words, visiting a booby-trapped page is the likely route in. The words “inside the sandbox” matter: Chrome walls web content off from the rest of your computer, so a full takeover would usually need a second bug to break out. Nobody has said whether attackers have one.
CISA has given US federal agencies until 24 November to patch. Government security teams elsewhere are also treating it seriously: NHS England’s cyber team says it “assesses further exploitation as likely”, and Hong Kong’s GovCERT warns the bugs in this update could lead to remote code execution.
Which versions are safe
- Chrome on Windows and Mac: 157.0.8103.50 or .51, or later.
- Chrome on Linux: 157.0.8103.50 or later.
- Chrome on Android: 157.0.8103.50 or later, rolling out through Google Play. Google says Android releases carry the same security fixes as the desktop ones unless noted.
- Chrome Extended Stable (used by some businesses): 156.0.8078.96 for Windows and Mac, which Google’s notes list as including CVE-2026-125350.
- Chromebooks: the latest ChromeOS stable release Google had posted when we checked, on 6 November, uses browser version 156.0.8078.93, which predates this fix. Keep an eye on Settings > About ChromeOS for an update.
A small number of Windows users were moved early to a Chrome 158 build on 4 November as part of Google’s staged “early stable” testing. Google’s notes don’t say whether that build includes this fix, so if you see a 158 version number, check again for updates.
Edge, Brave, Opera and Vivaldi
- Microsoft Edge: not patched yet when we checked on Wednesday 11 November. Microsoft’s Edge security release notes say: “Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix.” The latest Edge Stable release listed there, 157.0.4341.42, came out on 5 November, before Google’s fix. Check Settings > About Microsoft Edge over the next few days.
- Brave: version 1.99.56, released on 10 November, upgrades to Chromium 157.0.8103.50, the fixed version.
- Vivaldi: its desktop 8.3 minor update moves to Chromium 156.0.8078.99 and, according to Vivaldi, includes the CVE-2026-125350 fix.
- Opera: Opera says Opera 140, released on 10 November, fixes CVE-2026-125350.
How to update now
- On a computer, open Chrome’s menu (the three dots), go to Help > About Google Chrome, let it download the update, then click Relaunch. The fix doesn’t take effect until the browser restarts, so a Chrome window left open for weeks may still be running old code.
- On Android, open Google Play, search for Chrome and tap Update if it appears.
- Do the same in any other Chromium browser you use, via its own About page.
- Turn on automatic updates if you’ve switched them off, and restart browsers regularly.
Our read: what it means for Australians
Our read: for most people this is a two-minute job: update, relaunch, done. The risk is the gap between Google publishing a fix and your browser actually running it, especially for anyone who keeps dozens of tabs open and never restarts. With no details yet about who is being targeted, it is safest to assume more attackers will try to use the bug once the published fix can be studied.
For Australian organisations, the Australian Signals Directorate’s Essential Eight maturity model gives a clear yardstick. At its highest level, Maturity Level Three, patches for web browsers are to be applied “within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist”. Levels one and two allow two weeks. A known exploit is exactly the case the 48-hour rule targets. Teams that run Edge as the standard browser have a harder job, because they are waiting on Microsoft; they should be ready to push its update as soon as it lands. It is the same lesson as this week’s Apple security updates: the fix only protects you once it is installed.
This article is based on Google’s Chrome release notes and the advisories and reports linked above, published on 9 and 10 November US time. Browser versions and Microsoft’s Edge status were checked on Wednesday 11 November (Australian Eastern Daylight Time). We will update it if Google or Microsoft publish more details.
Featured image: a close-up of the HTTPS padlock in Google Chrome’s address bar, photographed in April 2014 (an older version of Chrome, shown for illustration). Photo: Yuri Samoilov via Wikimedia Commons, licensed under CC BY 2.0; resized and converted to PNG. Google and Chrome trademarks are shown for editorial purposes and do not imply endorsement.
.jpg){kind=link}