Tech News · Cybersecurity
Chrome zero-day update — what businesses should do now
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
— Google security advisory, via BleepingComputer
What happened
Google released an emergency Chrome zero-day update on Monday, November 9, 2026, fixing CVE-2026-125350, a high-severity flaw that attackers are already exploiting. It is the eighth actively exploited Chrome zero-day Google has patched in 2026, and the fix ships in Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux.
The bug is a use-after-free weakness in Chrome’s XML component. In plain terms, the browser frees a piece of memory but keeps a pointer to it, and an attacker who can shape what lands in that memory may be able to crash the browser, corrupt data or run their own code. An anonymous researcher reported the flaw on November 6. Google has not said who is behind the attacks or how they are being carried out, and it is keeping technical details restricted until most users have updated. The update is rolling out gradually over the coming days and weeks, so many machines will not have it yet unless someone forces the update.
FuzeForth’s take
For most small and mid-size businesses, the web browser is the front door to everything: email, banking, payroll, the CRM, the accounting system and every cloud app the team logs into. A browser flaw that is being exploited right now is not an abstract IT issue. It is a direct path to the accounts and data your business runs on, and you cannot control every web page your team happens to open.
The good news is the fix is simple. The risk is that “automatic” updates are not instant. Chrome only finishes installing an update when the browser is relaunched, and plenty of employees leave Chrome open for days or weeks with dozens of tabs. That gap is exactly what attackers count on. Microsoft Edge, Brave, Opera and Vivaldi are built on the same Chromium code, so if your team uses any of them, watch for their matching patches too.
What to do today: ask everyone to open Chrome’s menu, go to Help > About Google Chrome, let it update, and click Relaunch. If you manage more than a handful of computers, check that version 157.0.8103.50 or later is actually installed on each one rather than assuming it is. This is also a good moment to make sure someone owns browser and software patching in your business. If no one does, a managed website and security care plan can take that off your plate, and it is worth reviewing which business software tools your staff reach through the browser every day.
Key points
- Google patched CVE-2026-125350, a high-severity use-after-free bug in Chrome’s XML component, and confirmed it is being exploited in the wild.
- Fixed versions are Chrome 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux.
- It is the eighth actively exploited Chrome zero-day of 2026.
- The update rolls out gradually and only applies after Chrome is relaunched, so update and relaunch manually now.
- Other Chromium-based browsers such as Microsoft Edge and Brave should be updated as their vendors release fixes.
Frequently asked questions
How do I install the Chrome zero-day update?
Open Chrome’s three-dot menu, choose Help > About Google Chrome, wait for the download to finish, then click Relaunch. You should see version 157.0.8103.50 or later.
Is Microsoft Edge affected by the Chrome zero-day?
Edge and other Chromium-based browsers share Chrome’s underlying code, so security outlets advise applying their vendors’ fixes as soon as they are available. Check for updates in each browser’s About page.
What is a zero-day vulnerability?
A zero-day is a security flaw that attackers were exploiting before a fix was widely available. In this case Google has confirmed attacks are already happening, which is why updating right away matters.
