Google Confirms Chrome Flaw Is Being Exploited: Here’s What Users Should Do

Google has fixed a high-severity security vulnerability in Chrome after confirming that attackers are exploiting it in the wild. Identified as CVE-2026-125350, the flaw affects the browser’s XML component and could allow malicious code to run inside Chrome’s security sandbox when a user visits a specially crafted webpage.

The vulnerability was addressed in Google’s November 9 security release, but the company has since published another desktop update. The issue has also been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog, making it important for Chrome users to check that their browser is up to date.

Google classified CVE-2026-125350 as a high-severity use-after-free vulnerability. In simple terms, this type of programming error occurs when software attempts to use a piece of computer memory after that memory has already been released or reassigned. If an attacker can manipulate how the software handles that memory, it may create an opportunity to execute unintended code.

The affected component is Chrome’s XML functionality, which helps the browser process and handle XML-related content. According to the official CVE record, a remote attacker could exploit the flaw through a specially crafted HTML page, potentially executing arbitrary code inside Chrome’s sandbox. The browser’s sandbox is an isolation mechanism designed to limit what potentially dangerous code can access.

This distinction matters. Code execution inside the browser sandbox is serious, but it does not automatically mean an attacker can escape that sandbox, take complete control of Windows or macOS, or access everything stored on a device. No such additional compromise should be assumed from the vulnerability description alone.

Google’s November 9 Stable Channel security announcement identified CVE-2026-125350 as a high-severity flaw and explicitly stated that an exploit exists in the wild. This means exploitation has been observed, rather than the vulnerability being merely a theoretical security concern.

The vulnerability also has a user-interaction requirement. Its published technical assessment indicates that a user must interact with the attack in a way that allows the crafted page to be rendered. For an ordinary browser user, this could mean visiting a malicious webpage. Simply receiving an email or a message containing a link does not, by itself, establish that the vulnerability has been triggered.

The CVE’s published CVSS 3.1 score is 8.8 out of 10, placing it in the high-severity category. Its assessment identifies network-based exploitation, low attack complexity and the need for user interaction. The score describes the potential technical impact; it does not tell us how many people have actually been attacked.

There is also an important development from CISA. On November 10, the agency added CVE-2026-125350 to its KEV Catalog, a list of vulnerabilities for which evidence of exploitation exists. The agency’s announcement explained that six vulnerabilities had been added based on evidence of active exploitation.

CISA’s inclusion is significant because the catalog helps organisations prioritise security fixes that attackers are already using. The associated November 24 remediation deadline applies to relevant US Federal Civilian Executive Branch agencies under CISA’s requirements. It is not a deadline imposed on ordinary consumers or Chrome users in other countries.

Google’s original desktop fix was included in Chrome 157.0.8103.50/.51 for Windows and macOS, and 157.0.8103.50 for Linux. The November 9 release contained nine security fixes, not just this one vulnerability. Google’s release notes also identify other high-severity issues addressed in the same update.

Google subsequently published another Stable Channel desktop update on November 11. It brought Chrome to 157.0.8103.78/.79 on Windows and macOS and 157.0.8103.78 on Linux. That release included 83 security fixes. The November 11 release is newer than the original fix, so users should install the latest version offered by Chrome rather than deliberately stopping at the November 9 build.

Google also released Chrome 157.0.8103.78 for Android on November 11. The company said the Android release contains the same security fixes as the corresponding desktop releases unless otherwise noted. Availability through Google Play may take several days, so the update might not appear on every device immediately.

For Windows and Mac users, checking for the update is straightforward. Open Chrome, select the three-dot menu in the top-right corner, choose Help and then About Google Chrome. The browser will check for available updates and display its installed version. If an update is ready, allow it to install and select Relaunch when prompted. Restarting is important because it allows the updated browser to take effect.

Android users can open the Google Play Store, tap their profile icon, select Manage apps and device, and look for Chrome under available updates. Tap Update if the option appears. Users can also open Chrome’s Settings and select About Chrome to check the installed version. Google’s official Android update instructions provide the same process.

Linux users should update Chrome through their distribution’s supported package manager or software-update mechanism. Chromebook owners should check for ChromeOS system updates through the device’s settings because Chrome browser updates on ChromeOS are managed through the operating-system update process.

Users should not assume that every Chromium-based browser has received the fix automatically. Opera confirmed that its November 10 Opera 140 release included a fix for CVE-2026-125350. Vivaldi also confirmed that its November 10 desktop and Android updates incorporated the relevant Chromium security fix. Opera’s announcement and Vivaldi’s release notes document those changes. For Microsoft Edge and Brave, users should check their respective vendors’ release notes rather than assume that a particular version contains the fix.

Google has confirmed exploitation, but the public information reviewed does not identify the attackers, name specific victims or establish how many people have been affected. It also does not establish that passwords, banking information or other personal records were stolen through this vulnerability. These details should not be inferred from the fact that exploitation is occurring.

For readers, the most useful response is to update Chrome promptly, restart the browser and check its installed version. Avoid opening suspicious links, keep extensions limited to trusted sources and do not postpone browser security updates. Secritic has also examined how deceptive SVG files can be used in phishing attacks, a separate technique that reinforces why unexpected links and attachments deserve caution.

Actively exploited browser vulnerabilities are a reminder that even familiar applications can contain serious security weaknesses. Updating Chrome will not eliminate every online risk, but installing the available security fixes is one of the simplest steps users can take to reduce their exposure to known attacks.