Chrome's eighth zero-day of the year is in the part that reads XML, and the fix needs a restart

Google pushed out a Chrome update on Monday, 9 November, with nine security fixes in it. One matters more than the rest. CVE-2026-125350 is a memory bug in the part of Chrome that handles XML, a plain data format websites use behind the scenes, and Google's advisory carries the sentence nobody likes to read: "Google is aware that an exploit for CVE-2026-125350 exists in the wild."

That makes eight exploited Chrome zero-days in 2026 by BleepingComputer's count, level with the whole of 2025 and with seven weeks still to go. Two of the others were fixed in September. According to CyberInsider, an anonymous researcher reported this one on 6 November, so Google turned the fix around in three days. As usual it isn't saying who is using the bug or against whom, and the technical details stay locked until most people have updated. What's known is the type: a use-after-free, where the browser keeps using a piece of memory it has already handed back, and a booby-trapped web page can abuse that to run its own code.

The fixed version is 157.0.8103.50 or .51 on Windows and Mac, and 157.0.8103.50 on Linux. Chrome fetches it quietly, but here's the catch: a downloaded update protects nothing while the old browser is still running. If you keep forty tabs open for weeks, open the three-dot menu, choose Help, then About Google Chrome, wait for the check to finish and click Relaunch. Your tabs come back. Edge, Brave, Opera and Vivaldi are built on the same Chromium code, so expect their own updates to follow, and take them when they're offered.

Tendvane's app-update check, which uses winget, will tell you if Chrome or another browser on your PC is still sitting on an older version.