Chrome fixes exploited XML bug as updates roll out in stages

Chrome, Google's web browser, has a fix for CVE-2026-125350, an XML memory-safety flaw that Google says attackers are exploiting. Install the patched build and restart desktop Chrome. Downloading it is not enough. The desktop fixes are available now, while Android users are receiving the patched release in stages through Google Play. On either platform, check the installed version rather than stop at the release announcement.

Google released the fix on November 9, 2026, following an anonymous report on November 6, according to AndroidPure. This is the eighth actively exploited Chrome zero-day fixed in 2026, The Hacker News reports. The attack details remain undisclosed. As of November 10, 2026, Google has not said who was targeted or how attackers exploited the vulnerability.

Which Chrome builds fix CVE-2026-125350?

Google's Stable-channel notice lists the desktop builds fixed for CVE-2026-125350 below. Brandefense's deployment guidance calls for an update and a restart for each version; neither step replaces the other. Check the build number for the operating system actually in use. Chrome reporting that an update exists is not the same check.

Desktop delivery will run over the coming days and weeks, Google says. Publication is not deployment. A fixed build can be available before a particular workstation receives it, so verify the installed version on the workstation in a managed environment. The release announcement alone tells you nothing about whether automatic updating has finished across the fleet.

Updating desktop Chrome and checking a managed fleet

Open Chrome's update page, relaunch the browser, and check the active version against the platform-specific build above. Then check the gaps. For a company laptop fleet, that means accounting for devices that were inactive during the update window, not just reading the deployment report for the devices that were available.

1. Open More > Help > About Google Chrome.
2. Select Relaunch to activate the update.
3. Check the active Chrome version against the fixed build for that operating system.

Brandefense recommends comparing managed-browser reports with endpoint inventory. Confirm the installed build and whether Chrome restarted; check, too, whether managed policies report a successful rollout. Unreachable systems still need an entry. Record an exception with a follow-up date for every system that cannot be reached, rather than leaving its patch status unresolved.

Consider putting unreachable devices on an explicit exception list when coordinating this rollout alongside a GitLab patch check, rather than counting an endpoint's silence as a successful deployment. An update assignment records a request. It does not confirm completion. For that, the useful signal is confirmation that the fixed Chrome build is active on the endpoint.

Updating Chrome on Android during the Play Store rollout

On Android, version 157.0.8103.50 or later contains the fix, according to AndroidPure. Google Play delivers it in stages. That distinction matters on the phone in front of you: an older version can still be installed after the patched release has been announced. The announcement establishes that the release exists, not that this phone has received it.

The Android release notes mention stability and performance improvements. They do not mention this vulnerability. AndroidPure explains that Google cross-references the corresponding desktop security fixes, and Android releases carry those fixes unless Google notes otherwise. The vulnerability therefore need not appear by name in the Android release notes for the corresponding fix to be included.

I'd check manually for an available update rather than wait for automatic delivery. Start with the installed version, using the documented path below, then look in Google Play for a Chrome update if that version is older than the fixed build:

1. In Chrome, navigate through More > Settings > About Chrome.
2. Compare the displayed version with the fixed Android build above.
3. For an older build, open the Play Store app's profile menu at the top right.
4. Tap Manage apps & device.
5. Under Updates available, tap Update for Chrome.

No Chrome entry in the updates list? AndroidPure says that means the new build has not reached that phone yet. Check again over the following days. A manual check can find an update already available to the device, but it cannot bypass staged delivery. If the phone is still waiting for the build patched for CVE-2026-125350, checking manually does not change that.

Chrome's XML flaw has no public attack details

CVE-2026-125350 is a High-severity use-after-free in Chrome's XML component. Google confirms active exploitation. It has not named the attacker, identified the targets or campaign, or said which platform the attacks hit. Those details remain unknown from Google's disclosure.

A use-after-free occurs when software accesses memory after that memory has been freed. Successful exploitation of this class of vulnerability can cause data corruption, crashes, or arbitrary code execution. Those are possible consequences, not reported outcomes here. Google has not disclosed that the attackers achieved any of those results with CVE-2026-125350.

Google's notice gives no numerical CVSS score, and SecurityWeek reports that CISA has not yet added the vulnerability to its Known Exploited Vulnerabilities catalog. I'd act on Google's confirmation of exploitation without waiting for either of those additional labels, even with other work such as the Node.js Brotli bug already in the patch queue. The confirmation is already there.

Google says bug details may stay restricted until a majority of users have updated. There is another stated reason for withholding details: an affected third-party library may have dependent projects that have not yet fixed the issue. Google has not said that applies here. It is a reason Google gives for restricting disclosures, not a disclosed explanation specific to CVE-2026-125350.

Brandefense notes that Google's notice includes neither indicators of compromise nor details of post-exploitation behavior. The patch notice cannot fill those gaps. Where endpoint evidence suggests a compromise, Brandefense's guidance is to preserve the relevant browser and endpoint records and follow an incident response plan, rather than expect the release notice to supply the missing attack details.

Chrome's other fixes extend beyond the exploited XML bug

The update contains nine security fixes: seven rated High and two rated Medium. CVE-2026-125350 is not the whole patch. Google's notice lists the additional issues below, and deploying this update addresses those vulnerabilities alongside CVE-2026-125350 that Google has publicly confirmed attackers are exploiting.

Chrome's patch does not confirm other Chromium browsers are fixed

Microsoft Edge, Brave, Opera, and Vivaldi users are advised to apply fixes for their browsers as those fixes become available. Those are separate patch checks. The Chrome build numbers above establish Chrome's patch status; they do not establish whether any of those other products has received its own fix.

I'd inventory those browsers separately rather than treat a successful Chrome rollout as coverage for every Chromium-based browser on the inventory. The reporting gives no fixed builds for Edge, Brave, Opera, or Vivaldi. Check update availability for each browser separately before counting that browser as patched.