.png "Global Insight")
If you use Google Chrome, stop what you are doing and update it. Google released an emergency security update on Monday, November 9, after confirming that attackers are already exploiting a flaw in the browser — the eighth Chrome zero-day exploited in the wild this year. The fix is ready. The only question is whether you have installed it.
What the flaw is
According to reports from BleepingComputer and The Hacker News, the vulnerability is tracked as CVE-2026-125350 and rated high severity. It is a use-after-free bug in Chrome's XML component — a memory flaw that occurs when the browser's XML parser deletes an object from memory but fails to clear the pointer to it, so a later operation can reach memory it should no longer touch. Attackers who lure a victim to a malicious page can use that confusion to corrupt memory and, in the worst case, run their own code on the victim's machine. Google said it is "aware that an exploit for CVE-2026-125350 exists in the wild." An anonymous researcher reported the flaw on November 6, and Google has not shared details of the attacks or who was targeted, keeping the technical details restricted until most users have updated.
How zero-day attacks actually work
A zero-day is a flaw nobody knew about until it was already being used. The name comes from the fact that developers have had zero days to fix it. The usual chain is simple: an attacker builds a web page or a file that triggers the flaw, the victim opens it — often through a link in a message or an ad — and the browser's mistake hands the attacker a foothold. From there, the attacker can steal stored passwords and session cookies, install further malware, or move deeper into the victim's computer. This is why browser zero-days are prized by both criminals and state-backed groups: the browser is the one program almost everyone runs, and it handles untrusted content from the internet all day. Google has now fixed eight actively exploited Chrome zero-days in 2026 — the earlier seven were CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046 and CVE-2026-87491 — and eight more in 2025. The pattern is the point: browsers are patched constantly because attackers probe them constantly.
How to protect yourself in two minutes
The update is included in Chrome 157.0.8103.50 or .51 for Windows and macOS, and 157.0.8103.50 for Linux, with an Extended Stable release of 156.0.8078.96 for managed machines. The release also patches eight other security bugs, including flaws in WebGL, FileSystem, V8 and the GPU. To check your version, open Chrome, go to Settings, then About Chrome — the browser will fetch the update automatically. Then relaunch it: the patch does not take effect until the browser restarts, and Google's own documentation stresses that a pending update is not a protected one. The US cybersecurity agency CISA has not yet added this flaw to its Known Exploited Vulnerabilities catalogue, but that is a matter of process, not of risk — Google's own confirmation that an exploit exists in the wild is enough. Update, relaunch, and you are done. For how Google's AI is reshaping the browser itself, see our report on Gemini 4 refactoring Chrome's code and why governments are telling citizens to stockpile.