Chrome CVE-2026-125350 Is Exploited: Update Now

Chrome CVE-2026-125350 is under active exploitation, according to Google. Update Windows and macOS systems to Chrome 157.0.8103.50 or .51, and Linux systems to 157.0.8103.50.

Google describes the vulnerability as a use-after-free issue in XML. The company has not disclosed the attacker, targets, campaign, or technical exploitation details.

Which Chrome CVE-2026-125350 Builds Are Fixed?

Google says the Stable Channel update will roll out over the coming days and weeks. Managed environments should verify the installed build instead of assuming automatic updates have completed.

The update also contains other security fixes, but Google’s notice marks CVE-2026-125350 as the issue with in-the-wild exploitation. The opened records provide neither a CVSS 3.1 score nor a CVSS 4.0 score.

Do This Now for Chrome CVE-2026-125350

1. Inventory desktop ChromeIdentify Windows, macOS, and Linux systems running Chrome in your environment.
2. Deploy the fixed buildUse your supported browser-management process to move each platform to the fixed version.
3. Restart the browserA downloaded update does not protect the running browser until Chrome restarts.
4. Verify the versionConfirm the active build after restart and record systems that remain below the fixed release.
5. Escalate exceptionsPrioritize internet-facing workstations and users who handle sensitive applications when an immediate update is blocked.

Use a documented patch management process to track deployment and restart status. A vulnerability management workflow can help owners prioritize systems that miss the first rollout.

Google’s notice does not provide indicators or describe post-exploitation behavior. If endpoint evidence suggests compromise, preserve relevant browser and endpoint records and follow an incident response plan.

What Can Defenders Confirm Today?

Teams can confirm the installed Chrome build, whether the browser restarted, and whether managed policies report a successful rollout. These checks provide direct evidence that the fixed code is active.

Managed-browser reports should be compared with endpoint inventory because inactive devices may miss the first update window. Owners should record an exception and a follow-up date for every unreachable system.

Google says the flaw was reported anonymously on 6 November 2026. The release notice does not attribute the exploitation or identify affected organizations.