> ## Content Index > Fetch the complete content index at: https://blog.harshkohli.com/llms.txt > Use this file to discover other available public pages before exploring further. # Chrome Zero-Day Under Attack: Update to 157 Now - URL: https://blog.harshkohli.com/chrome-zero-day-cve-2026-125350-update/ - Published: 2026-11-12T13:33:44.000Z - Updated: 2026-11-12T13:33:44.000Z - Description: Google fixed CVE-2026-125350, Chrome's eighth exploited zero-day of 2026. How to check your version, relaunch, and protect Edge and Android. - Author: Harsh Kohli - Tags: Tech News, security If you haven't restarted Chrome this week, do it now. Google has patched a bug in Chrome that attackers are already using, tracked as CVE-2026-125350, and the fix only kicks in once the browser relaunches. It's the eighth Chrome zero-day of 2026, and a bigger follow-up update landed on Wednesday too. ## What happened On Monday, November 9, Google pushed Chrome 157.0.8103.50/.51 to Windows and Mac and 157.0.8103.50 to Linux. The [Chrome Releases post](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop%5F018223192.html?ref=blog.harshkohli.com) lists nine security fixes, and one line matters more than the rest: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." The bug is a use-after-free in Chrome's XML code, rated high severity. In plain terms, Chrome frees a chunk of memory while processing XML but keeps a pointer to it, and a crafted web page can abuse that leftover pointer to run its own code. Google credits two reports: one from Arni Hardarson of Neonix Security on October 12, and an anonymous one on November 6\. As usual, Google hasn't said who was attacked or how. A day later, on November 10, the US Cybersecurity and Infrastructure Security Agency added the flaw to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=blog.harshkohli.com) and gave federal agencies until November 24 to patch. CISA's entry notes that it can affect other Chromium browsers too, naming Microsoft Edge and Opera. Then on Wednesday, November 11, Google shipped [Chrome 157.0.8103.78/.79](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop%5F01744469280.html?ref=blog.harshkohli.com) with another 83 security fixes, five of them rated critical. None of those are marked as exploited, but it's the version you'll want to end up on anyway. Android got 157.0.8103.78 the same day. ## Why it matters A zero-day that's already in use is different from a routine patch. Someone had working attack code before the fix existed, and now that the patch is public, more people can study the change and build their own. [SecurityWeek](https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/?ref=blog.harshkohli.com) lists the seven earlier Chrome zero-days this year, which says a lot about how much attention the browser gets. The weak spot is the restart. Chrome downloads updates quietly, but plenty of people leave it open for days with dozens of tabs, so the patched version sits there unused. The Edge situation is also worth watching. On November 9 Microsoft's [Edge security release notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security?ref=blog.harshkohli.com) said it was "aware of the recent exploits" and working on a fix. When I checked on November 12, Edge for Android 157.0.4341.53 was listed with the fix, but the newest desktop Stable entry was still 157.0.4341.42 from November 5. ## What to do now **1\. Check your Chrome version.** Type `chrome://settings/help` into the address bar. Chrome will show your version and start downloading anything newer. You want 157.0.8103.50 or higher at minimum, and ideally 157.0.8103.78. **2\. Click Relaunch.** This is the step people skip. Chrome reopens your tabs, so you won't lose anything. **3\. On Android,** open the Play Store, search for Chrome and tap Update if it shows up. On iPhone, update through the App Store. **4\. On Edge,** go to `edge://settings/help` and install whatever's waiting, then check again over the next few days until Microsoft posts the desktop fix. Brave, Opera and Vivaldi users should do the same from each browser's About page. **5\. If you manage PCs for a team,** don't rely on users restarting. Use your policy tools to force a relaunch after updates, and make sure Extended Stable machines are on 156.0.8078.96 or later, since Google put the same fix into that channel. ## My take I'd do this before bed tonight. It takes thirty seconds, and the only thing it costs you is a browser restart. Who's actually at risk? Honestly, if you're a regular home user, probably not you specifically. Exploits like this tend to be used against chosen targets, and New York's IT office [rates the risk for home users as low](https://its.ny.gov/2026-127?ref=blog.harshkohli.com) while putting larger organisations at high. But "probably" isn't a great security plan, and the pool of people with working exploit code only grows from here. Journalists, people who work in finance or government, and anyone who handles company admin accounts in the browser should treat this as urgent. For readers in India, the bigger gap I see is on phones. A lot of people turn off Play Store auto-updates to save mobile data, and Chrome can sit months behind as a result. Open the Play Store's Manage apps screen and check whether Chrome is waiting for an update. While you're there, glance at Android System WebView too, since many apps use it to show web pages. This is also the second big Chrome security drop in a few weeks. In October I covered [Chrome 156's 52 fixes, many found with Claude](https://blog.harshkohli.com/chrome-156-security-update-claude/), and with AI tools finding bugs faster, I don't expect these release notes to get shorter. If Chrome feels sluggish after updating, our guide to [fixing Chrome using too much memory](https://blog.harshkohli.com/chrome-using-too-much-memory/) helps, and the [Windows 11 100% disk usage fix](https://blog.harshkohli.com/windows-11-100-disk-usage-fix/) covers the wider slowdown cases. If you think something already got onto your PC, start with our [malware check guide](https://blog.harshkohli.com/nikke-pc-launcher-malware-check-clean/). Sources: [Chrome Releases (Nov 9)](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop%5F018223192.html?ref=blog.harshkohli.com), [Chrome Releases (Nov 11)](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop%5F01744469280.html?ref=blog.harshkohli.com), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-125350?ref=blog.harshkohli.com), [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?ref=blog.harshkohli.com), [Microsoft Edge security release notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security?ref=blog.harshkohli.com), [BleepingComputer](https://www.bleepingcomputer.com/news/security/google-patches-eighth-chrome-zero-day-exploited-in-attacks-this-year/?ref=blog.harshkohli.com) and [SecurityWeek](https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year/?ref=blog.harshkohli.com).