Google pushed Chrome 157.0.8103.50 on 9 November with nine security fixes, one of which closes a use-after-free in the browser's XML handling that is already being used in attacks.
What happened
Google's stable channel advisory lists CVE-2026-125350 as a high-severity use-after-free in the XML component, reported anonymously on 6 November, two days before the fix shipped. The advisory states that Google is aware an exploit for this flaw exists in the wild.
The same build carries eight other fixes: five high-severity issues in WebGL, FileSystem, Compositing, GPU and V8, plus two medium GPU problems found internally. Only the XML flaw is confirmed as exploited, and Google has released no detail on how the attack works.
That makes it the eighth Chrome zero-day exploited this year. The pattern across 2026 is consistent: a memory-safety bug in a rendering or parsing component, a silent fix, and confirmation of exploitation on release day.
Who is affected
Anyone browsing with a Chrome build older than 157.0.8103.50 on Windows, macOS or Linux.
- Windows and macOS: anything below 157.0.8103.50 / .51
- Linux: anything below 157.0.8103.50
- Endpoints where the update downloaded but the browser was never restarted
What to do now
Force the update, restart the browser, then verify the build number on the endpoint rather than trusting that it happened.
- Chrome menu, Help, About Chrome downloads the update and displays the installed version
- Confirm 157.0.8103.50 or later across managed desktops, laptops and any server used for web browsing
- Fully close and reopen the browser so the patched build is the one in memory
- Push the update through your endpoint tooling instead of relying on users to click restart
What this means for South African businesses
Chrome updates itself, so the real gap is the restart: in the offices we see, the download sits pending for days because nobody closes the browser, and the old build stays live. A drive-by exploit needs one visit to a hostile or compromised page, which makes a neglected reception or accounts machine the realistic entry point for an SME rather than an exotic targeted attack. Treat browser build numbers as a patching metric you actually report on.
Source: Chrome Releases, Stable Channel Update for Desktop, 9 November 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.