If you use Google Chrome on a computer, it is worth restarting it today. Google released a security update on Monday, November 9, after learning that attackers were already exploiting one of the flaws it fixes.
“Google is aware that an exploit for CVE-2026-125350 exists in the wild,” the company wrote in its release notes. BleepingComputer counts it as the eighth Chrome flaw this year to be exploited before a fix was available. Security researchers call these zero-days, because developers had zero days of warning before attacks began.
What was fixed
The new version is Chrome 157.0.8103.50 or .51 for Windows and Mac, and 157.0.8103.50 for Linux. The update contains nine security fixes in total, seven rated high severity and two rated medium.
The exploited flaw, CVE-2026-125350, is what programmers call a use-after-free bug in the part of Chrome that handles XML, a common format for structured data on the web. In simple terms, the browser frees up a piece of memory when it is done with it, then later tries to use that same memory again. An attacker who controls what ends up there can sometimes use the mistake to run their own code.
Google credited an anonymous researcher who reported the problem on November 6, three days before the fix shipped. As usual, the company has not said who was attacked or how, and it keeps technical details private until most users have updated.
How to update Chrome on a computer
- Open Chrome and click the three-dot menu in the top right corner.
- Choose Help, then About Google Chrome.
- Chrome checks for updates and downloads the new version automatically.
- Click Relaunch. Your tabs reopen after the restart.
When the page says Chrome is up to date and shows a version beginning with 157.0.8103.50 or higher, you are protected against this flaw. Google says the release will roll out over days or weeks, but checking manually usually gets it right away.
Chrome downloads updates in the background, but they only take effect after the browser restarts. If you leave Chrome open for days or weeks, as many people do, you may still be running the old version. A colored “Update” button near the top right corner is a sign that a restart is waiting.
What about other browsers?
Microsoft Edge, Brave, Opera, Vivaldi and several other browsers are built on Chromium, the open-source project behind Chrome, so they share much of its code. Their makers ship security fixes on their own schedules. It is a good idea to check for updates in any Chromium-based browser you use, usually under Help or About in the main menu.
If your company manages your computer, the IT team may control when updates are installed. In that case, restarting the browser when prompted is still the most important step.
A busy year for Chrome security
Eight exploited flaws in about ten months is a lot, though not unusual for the world’s most popular browser, which makes it an attractive target. Earlier in 2026, Google fixed exploited bugs in Chrome’s handling of fonts in February, in its graphics library and its JavaScript engine in March, in its WebGPU graphics code in April and in the JavaScript engine again in June, among others.
These attacks are often targeted at specific people, such as journalists, activists or executives, rather than everyday users. But once a fix is public, criminals can study it and try to build their own versions of the attack, which is why updating quickly matters for everyone.
Simple habits that help
- Restart your browser at least once a week, or whenever Chrome shows that an update is waiting.
- Keep automatic updates on for your operating system and apps, including on your phone.
- Remove extensions you no longer use. Fewer add-ons means fewer ways in.
- Be careful with links in unexpected emails and messages, which are a common way to lure people to booby-trapped web pages.
