By Shar Z, Security Engineer at Nine-Security

On Monday, November 9, 2026, Google shipped a Chrome Stable update that fixes nine security bugs. One of them, CVE-2026-125350, is already being exploited: Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." It is the eighth actively exploited Chrome zero-day fixed this year.

What happened

CVE-2026-125350 is a high-severity use-after-free in Chrome's XML component, reported anonymously on November 6, 2026. That's only three days from report to patch.
Google hasn't said who is exploiting it, who's being targeted, or how the exploit is delivered. Bug details stay restricted until most users have updated.
CyberInsider reports that the public Chromium patch linked to the bug ID points to libxslt, the library Chrome uses for XSLT transformations of XML documents. According to that patch, a nested XML evaluation could free and replace a cached object in libxslt's pattern-matching cache while an earlier operation still held the old memory address.
As of SecurityWeek's report on November 10, CISA had not yet added it to the KEV catalog.

Fixed versions

Windows and macOS: 157.0.8103.50/.51
Linux: 157.0.8103.50

The same release also fixes six other high-severity bugs (another XML use-after-free, CVE-2026-125346; a V8 type confusion; a GPU out-of-bounds write; a Compositing buffer overflow; incorrect authorization in FileSystem; and an uninitialized resource in WebGL), plus two medium-severity GPU issues.

Who's affected

Anyone running Chrome below the fixed versions. Because the root cause appears to be in libxslt, a shared library, other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be watched for their own updates, and software that embeds libxslt deserves a look once upstream details are public. That last part is my inference, not something Google has confirmed.

What to do now

Update and relaunch. Go to Menu, then Help, then About Google Chrome, let it download, and click Relaunch. A downloaded update doesn't protect a browser that is still running.
Enforce it across the fleet. Use Chrome Browser Cloud Management, Intune, or GPO to set a minimum version of 157.0.8103.50 and a forced relaunch deadline (for example, the RelaunchNotification and RelaunchNotificationPeriod policies).
Find stragglers. Pull browser versions from your EDR or asset inventory and list endpoints still below 157.0.8103.50. Long-running browser sessions are the usual blind spot.
Track Chromium derivatives. Check Edge, Brave, Opera, and Vivaldi release notes and patch them when the fix lands.
Hunt quietly. Since Google hasn't published IOCs, look for unusual child processes spawned by browser processes and unexpected browser crashes on high-value users' machines (executives, admins, finance) since early November.
Watch KEV. If CISA adds the CVE, federal remediation deadlines will follow. Treat it as KEV-grade anyway.

Takeaway

Report on November 6 and patch on November 9 is about as fast as it gets, but the patch only protects you after the browser restarts. Measure your fleet's time-to-relaunch, not just time-to-download.