Google lists fixed Chrome builds for CVE-2026-125350

Google’s November 9, 2026, Chrome Stable notice classifies CVE-2026-125350 as a high-severity use-after-free flaw in XML and says an exploit exists in the wild. Google listed fixed Chrome builds for Windows, Mac, Linux, and Android; the exact version depends on your operating system. Google’s desktop notice also credits two reports of the vulnerability, including one from Arni Hardarson of Neonix Security.

Match the Chrome build to your operating system, then check the version installed on your device.

What Google said about CVE-2026-125350

A use-after-free flaw occurs when software tries to use memory after it has been released. Google rated this flaw High and said an exploit for it exists in the wild. That statement concerns exploitation of the vulnerability; it does not establish that any particular Chrome user or organization was compromised. Google’s notice identifies the affected component as Chrome’s XML code.

Chrome builds Google listed

Google listed these Chrome Stable builds in its November 9 desktop and Android notices:

Google said the Android release includes the security fixes from the corresponding desktop releases unless otherwise noted. Its Android notice lists Chrome 157.0.8103.50.

Rollout timing and checking for the update

In its November 9 notices, Google said the desktop rollout would take the coming days or weeks, and that the Android release would become available through Google Play over the next few days. Those were Google’s rollout estimates at the time of the notices. Google’s desktop notice gives the desktop timing; the Android notice gives the Play timing.

On desktop, open Help > About Google Chrome to check for an update, then relaunch Chrome after it downloads. Techlicious recommends this built-in update check and relaunch step.

Google’s notice records two reports

Google’s desktop notice lists Arni Hardarson of Neonix Security as reporting the vulnerability on October 12, 2026. It also lists a separate anonymous report dated November 6. The notice was published on November 9.

NeoTeo previously covered a different Chrome Stable security update in its earlier Chrome security coverage.