This article was written with the help of AI. We used an AI assistant to draft it, then checked the details against Google's release notes and CISA's catalog. Sources are linked throughout.
On November 9, 2026, Google released Chrome 157.0.8103.50/.51 for Windows and Mac with nine security fixes. One of them, CVE-2026-125350, is a use-after-free bug in Chrome's XML handling, and Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild."
CISA added it to its Known Exploited Vulnerabilities catalog on November 10, with a November 24 deadline for federal agencies. CISA describes it as a flaw that could let a remote attacker run code inside the browser's sandbox through a specially crafted web page, and notes it could affect other Chromium browsers such as Microsoft Edge and Opera.
Why This Keeps Happening
Browsers are the program staff use most and the one that touches the most untrusted content. That makes them a steady target. Each exploited Chrome bug is fixed quickly by Google, but the fix protects only the PCs that actually move to the new version.
Chrome downloads updates in the background, then waits for a restart. Google's release notes also say the update rolls out "over the coming days/weeks," so not every PC gets it on day one.
Check Your PCs Today
- On each computer, open Chrome and go to Help > About Google Chrome. That page checks for and installs updates.
- Click Relaunch if it offers one. Chrome reopens your tabs.
- Confirm the version is 157.0.8103.50 or later.
- Do the same in Microsoft Edge under Settings > About Microsoft Edge.
Make It Managed, Not Hoped For
Checking ten PCs by hand works once. It does not work every few weeks. A managed setup does three things:
- Keeps automatic updates on. Google publishes update policies for Windows that admins can set centrally, so nobody can turn updates off on their own machine.
- Prompts, then forces, a restart. Chrome and Edge both have management settings that remind users to relaunch for a pending update and can relaunch the browser after a grace period you choose.
- Reports versions back. A management tool that shows which PCs are behind turns "I think we're patched" into a list you can act on.
The same approach applies to Windows and Office. The Outlook zero-day fixed the day after this Chrome update is a good example; see our post on CVE-2026-124194.
Sources
- Google Chrome Releases: Stable Channel Update for Desktop (November 9, 2026)
- CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-125350 added November 10, 2026)
- NIST National Vulnerability Database: CVE-2026-125350
- Google Chrome Enterprise Help: Manage Chrome updates (Windows)
Common questions
Doesn't Chrome update itself?
It downloads updates on its own, but the new version only runs after Chrome restarts. Many people leave the browser open for weeks. Google's own documentation notes that users need to restart Chrome for update settings to take effect.
Does this affect Microsoft Edge?
CISA says the flaw could affect browsers built on Chromium, including Microsoft Edge and Opera. Check that Edge is current too.
How do I check which Chrome version a PC is running?
Open Chrome, go to the three-dot menu, then Help > About Google Chrome. The page shows the version and installs any waiting update. Version 157.0.8103.50 or later includes the fix.
