Chrome Flaw Used in Attacks: Update Browsers to Version 157

On Monday, November 9, Google released a Chrome update that fixes nine security issues. One of them, CVE-2026-125350, is a flaw in Chrome's XML component, and Google says it is aware that an exploit for it exists in the wild. On November 10, CISA added it to its Known Exploited Vulnerabilities catalog.

The short version: make sure Chrome on every company computer is on version 157.0.8103.50 or later, and that it has been relaunched. Update Microsoft Edge and other Chromium-based browsers too as their fixes arrive.

What the flaw does

CISA describes it as a use-after-free bug, a type of memory error, that could let a remote attacker run code inside the browser's sandbox through a specially crafted web page. In practice, that means simply visiting a malicious or compromised site in an unpatched browser could be enough. Google has not shared details about the attacks while users update.

Who is at risk

Anyone using Chrome before 157.0.8103.50/.51 on Windows or Mac, or before 157.0.8103.50 on Linux. CISA notes the flaw could also affect other browsers built on Chromium, including Microsoft Edge and Opera. CISA set a federal remediation due date of November 24, 2026.

What to do this week

1. Update Chrome. Open the menu, choose Help, then About Google Chrome. Chrome checks for the update and installs it.
2. Relaunch the browser. The fix does not take effect until Chrome restarts, and many people leave it open for weeks. Ask staff to close and reopen it today.
3. Check Edge and other browsers. In Edge, open Settings, then About Microsoft Edge, to install the latest version.
4. Confirm automatic updates are on for browsers on every computer, including shared and front-desk PCs.

Questions to ask your IT provider

1. Are all our computers on Chrome 157 or later, and have they been restarted?
2. Is Microsoft Edge up to date on our Windows PCs?
3. Can we see browser versions across all our computers in one place?