If you use Google Chrome, stop and update it today. Not this weekend, not when it gets around to restarting itself. Google released a security update on Monday, November 9, that fixes nine vulnerabilities — and one of them is already being exploited by attackers. That makes this a patch you install on purpose, and then verify.
What happened
The exploited flaw is tracked as CVE-2026-125350. Google rates it high severity. It is a use-after-free bug in Chrome’s XML component. In plain terms, a use-after-free is a memory mistake: the program frees a piece of memory, then tries to use it again anyway. An attacker who controls what lands in that memory can sometimes turn a crash into code running inside the browser.
An anonymous researcher reported the flaw to Google on November 6. Three days later, on November 9, Google shipped the fix and said plainly that it is aware an exploit for CVE-2026-125350 exists in the wild. That sentence is the whole ballgame. It means this is not a theoretical bug found in a lab. Somebody is already using it against real Chrome users.
SecurityWeek counts this as the eighth Chrome zero-day exploited this year. The same update also patches six other high-severity flaws in Chrome’s WebGL, FileSystem, Compositing, GPU, V8, and XML components, plus two medium-severity bugs described as uninitialized resource issues in the GPU component. Google discovered most of those other flaws internally, according to SecurityWeek’s reporting.
The fix is in Chrome 157. You want version 157.0.8103.50 or 157.0.8103.51 on Windows and Mac, and 157.0.8103.50 on Linux. Google also released Chrome 157.0.8103.50 for Android on November 9 with the same security fixes, and an Extended Stable update to 156.0.8078.96 for Windows and Mac users on that slower channel.
How bad is it, honestly?
Bad enough to act today, and I will tell you exactly what we do not know, because that matters too. Google has not shared details about the attacks — not who is behind them, not who is being targeted, and not how the exploit is being delivered. SecurityWeek reported that no public information on the exploitation was available when it covered the patch. As of that report, CISA had not yet added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog.
So I am not going to claim this is a mass campaign hitting everyone, and I am not going to claim it is only aimed at a handful of high-value targets. Neither is in the sources. What is established is narrower and still serious: a high-severity flaw in the world’s most widely used browser, an exploit that exists, and a fix that is already out. When the patch exists and the exploit exists, the only question left is which side of that line your browser is on.
Google also said the update will roll out over the coming days and weeks. That staged rollout is normal, but it is exactly why waiting is a bad plan. A browser that has downloaded an update but has not restarted has not applied it. I have seen machines sit in that pending state for days because somebody kept postponing the relaunch to keep their tabs open. Your tabs will come back. Relaunch.
What to actually do
First, update Chrome on every computer you use. Open Chrome, go to Help, then About Google Chrome. Chrome will check for the update and show you the version you are running. If an update is ready, click Relaunch. Afterwards, go back to that same About page and confirm you are on 157.0.8103.50 or 157.0.8103.51 on Windows or Mac, or 157.0.8103.50 on Linux. Do not just trust that auto-update handled it — verify the number.
Second, do the same check on your phone. Update Chrome for Android to 157.0.8103.50 through Google Play if you use it. If you are on an organization’s Extended Stable channel at work, your target is different — 156.0.8078.96 on Windows and Mac — so check with that version in mind instead of assuming the 157 number applies to you.
Third, if you manage computers for a family member, a small office, or clients, push this one. Check their version, relaunch the browser, and confirm it again after the restart. A downloaded-but-not-applied update looks done from a distance and is not.
Fourth, keep the usual discipline while details are still thin. Until Google releases more, be extra careful with unexpected links and downloads, and do not install browser extensions from outside the official store to chase a “fix” — the only fix for this is Google’s update itself. No website, pop-up, or email needs to sell you a patch for Chrome.
My bottom line: this is the cleanest kind of security decision. The flaw is confirmed, exploitation is confirmed, and the remedy takes about a minute. Update Chrome, relaunch it, verify the version number, and do the same for anyone who relies on you to keep their machines straight. That is the whole job today.
Sources: SecurityWeek, “Chrome Update Patches Exploited XML Zero-Day, Eighth This Year” (November 10, 2026) — securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year, summarizing Google’s Chrome Stable Channel update for desktop (November 9, 2026); Malwarebytes, “Update Chrome now to fix a flaw attackers are exploiting” (November 10, 2026) — malwarebytes.com.