Chrome 157.0.8103.50. That version number is not another routine weekly update: Google released it to close nine security vulnerabilities, including one zero-day already confirmed as exploited in the wild since 6 November 2026. The flaw is tracked as CVE-2026-125350, and its class is a use-after-free inside the XML component that processes documents. This release makes Chrome 157.0.8103.50 the patch that protects users from an actively exploited risk. Google shipped Chrome 157.0.8103.50 on Monday. The release patches nine vulnerabilities at once. Two are rated medium, while the rest are high or critical. The reason the update matters, though, is CVE-2026-125350. Google describes CVE-2026-125350 as a use-after-free in XML in Chrome versions prior to 157.0.8103.50. A remote attacker can craft an HTML page that, when loaded by a user, allows arbitrary code execution inside the sandbox. The impact is severe: document processing that manipulates XML becomes an entry point, and the Chrome sandbox makes the exploit more serious because code runs inside an environment that was meant to be confined. The CVSS score is likely 8.8, which is high severity. Google reported the bug to CVE.org and is listed as the Chrome CNA. The CVE.org record shows the bug was published on 10 November 2026. The researcher who reported it is an anonymous security researcher, who submitted it on 6 November. Google also acknowledged that an exploit for CVE-2026-125350 exists in the wild. The company did not detail how the exploit is being used. There is no information about whether the exploit has already hit specific users, who the targets were, or what the attackers wanted. That keeps this report neutral: the confirmed fact is that Google acknowledges active exploitation, not how it is implemented. The key point is that this is a zero-day under active exploitation. This is the eighth Chrome zero-day exploited in 2026. The previous list is CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and CVE-2026-87491. Each patched a major vulnerability path. Urging users to update Chrome is a sensible step. For users, the recommended action is to update Chrome to 157.0.8103.50 or later. On Windows and macOS, update to 157.0.8103.50. On Linux, 157.0.8103.50 covers the same line. Inside Chrome, users can go to Help > About Google Chrome to confirm the current version. Network administrators and enterprise patch managers such as Google Chrome Enterprise or Google Workspace can distribute the fix through their own update pipelines. Who is at risk? Users running a Chrome version older than 157.0.8103.50 are exposed. Through a malicious page that triggers this bug, an attacker can run code inside the Chrome sandbox. That means a web browser is a viable attack vector. People visiting untrusted sites or clicking suspicious links are at risk. What is not yet clear? Google did not provide details on which researcher reported CVE-2026-125350, only that an anonymous researcher submitted it on 6 November 2026. Google also did not say who was targeted by the in-the-wild exploit. That information may be classified or still under review. From a security standpoint, users who update promptly minimize their risk. For context, this release closes the path used to process XML documents. A browser that processes encrypted content or HTML with malicious markup from older versions was at risk. The CVE.org record shows affected versions are prior to 157.0.8103.50, covering Windows, macOS, and Linux, so all major desktop releases are impacted. Bottom line: Chrome 157.0.8103.50 arrives in response to an actively exploited flaw. Internet-facing users are the highest risk group, and updating is strongly recommended. For more information, see the Chrome release notes, the CVE-2026-125350 record on CVE.org, and reporting from SecurityWeek and The Hacker News. Sources: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html https://www.cve.org/CVERecord?id=CVE-2026-125350 https://www.securityweek.com/chrome-update-patches-exploited-xml-zero-day-eighth-this-year https://thehackernews.com/2026/11/google-issues-chrome-security-update.html https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20261110