Chrome Fixes Exploited XML Flaw: Relaunch to Apply the Update

Google has released a Chrome update for an XML flaw that already has an exploit in the wild. The fix is in the November 9 desktop release, with a corresponding Android update and a separate Extended Stable build. If Chrome has been sitting open for days, check its version and relaunch it: a downloaded update does not become the running browser until the restart. [1] [2]

The exploited XML bug is one of nine fixes

The vulnerability, CVE-2026-125350, is a high-severity use-after-free in Chrome’s XML component, reported anonymously on November 6. A use-after-free is a memory-safety error: software continues to use memory after releasing it. That describes the bug class, not a reconstruction of the attack.

Google’s release note confirms an in-the-wild exploit but does not identify victims, an attacker, a delivered payload or the complete exploit chain. The same release lists another XML use-after-free, CVE-2026-125346; Google’s exploitation statement specifically names CVE-2026-125350. It would be misleading to label every issue in the update actively exploited. Google is withholding some bug details while fixes reach users. [1]

Check the release channel as well as the number

These are the builds announced on November 9. Install the latest update offered for your supported device; a newer build can supersede the numbers below.

The lower major number on Extended Stable is intentional: Google lists this CVE in that channel’s separate security update. Do not judge a managed installation solely by whether its major version says 157. The Android announcement says it carries the corresponding desktop security fixes unless otherwise noted, with availability rolling out through Google Play. These release numbers are not an iOS or another Chromium browser’s patch list. [1]

A pending update still needs the relaunch

1. On a desktop, open Chrome’s menu, then Help → About Google Chrome, or enter chrome://settings/help in the address bar.
2. Let Chrome check for an update and select Relaunch when prompted. Save work first; Google notes that Incognito windows do not reopen automatically.
3. Return to About Chrome after the restart and check the running version. On Linux, Google directs users to their package manager. On a managed device, ask the administrator to resolve a blocked or unavailable update.

Google’s update instructions explain why merely leaving the browser open is insufficient: background updates normally apply when Chrome closes and reopens. Android users should check the Chrome update in Google Play rather than compare their phone against a desktop-only channel. [2] [1]

Use the browser’s own update path, not an installer offered by an unsolicited web page. If a supposed update already opened a terminal or ran a download, that is a separate problem covered in our fake Chrome update guide; applying this patch does not undo a separate malware installation.

The useful distinction is between an available fix and the version actually running. Check the channel, apply its update and verify again after relaunching.

References

1. Google Chrome Releases. “Stable Channel Update for Desktop,” “Extended Stable Update for Desktop,” and “Chrome for Android Update.” November 9, 2026; accessed November 11, 2026. Official November release archive.
2. Google Chrome Help. “Update Google Chrome.” Accessed November 11, 2026. Update, relaunch and check the version.