Cybersecurity
Chrome Zero-Day CVE-2026-125350: What Indian Firms Must Do
Affix Center · · 5 min read
In short: Google has released a Chrome security update that fixes CVE-2026-125350, a high-severity use-after-free flaw in Chrome's XML component that Google says is already being exploited. It is the eighth exploited Chrome zero-day fixed in 2026. Update Chrome to version 157.0.8103.50 or later on every office computer and relaunch the browser.
Your staff open web pages all day: supplier portals, GST and banking sites, email links and search results. A browser flaw that attackers are already using turns any one of those pages into a possible entry point. The fix is available, but it only protects a computer after Chrome has updated and been restarted, and on many office PCs that does not happen for days.
What Happened
Google released a Stable channel security update for Chrome desktop on Monday, 9 November 2026, according to reports by The Hacker News and BleepingComputer, both dated 10 November 2026. The update fixes nine security issues. One of them, tracked as CVE-2026-125350, is a high-severity use-after-free bug in the XML component.
Google stated that it is aware that an exploit for CVE-2026-125350 exists in the wild. The Hacker News reports that the flaw was reported by an anonymous security researcher on 6 November 2026. Google has not shared how the flaw is being used or who is behind the attacks, and as usual it may keep bug details restricted until most users have updated.
The fixed versions, as reported, are:
| Platform | Fixed Chrome version |
|---|---|
| Windows | 157.0.8103.50 or 157.0.8103.51 |
| macOS | 157.0.8103.50 or 157.0.8103.51 |
| Linux | 157.0.8103.50 |
BleepingComputer counts this as the eighth actively exploited Chrome zero-day that Google has fixed in 2026. You can check Google's own release notes on the Chrome Releases blog.
Who Is Affected
- Any organisation whose staff use Google Chrome on Windows, macOS or Linux and have not yet updated to the fixed version.
- Users of other browsers built on Chromium, such as Microsoft Edge, Brave, Opera and Vivaldi. The Hacker News advises these users to apply fixes as and when their vendors release them.
- Shared and kiosk computers, front-desk PCs and computers in branches or plants that are rarely restarted.
- Government offices and departments where users browse many external portals from the same machines they use for official files.
What It Means for an Indian Business or Department
A use-after-free bug is a memory error: a program keeps using a piece of memory after it has been released. Attackers can sometimes use such bugs to run their own code when a user opens a specially crafted page. Because Google says an exploit already exists, this is not a theoretical risk.
The weak point in most offices is not the patch itself. Chrome downloads updates on its own, but the fix only takes effect after the browser restarts, and many users keep Chrome open for days. Machines with update policies turned off, old operating systems, or no central management may not update at all. If you cannot say today which computers are on the fixed version, that is the gap to close.
We covered a similar case in our note on the October 2026 Chrome security update. The pattern repeats every few weeks, which is why a steady patch management process matters more than a one-time scramble.
What to Do Now
- Update Chrome on every computer. Open More, then Help, then About Google Chrome, let the update download and click Relaunch. Confirm the version is 157.0.8103.50 or later.
- Force a restart of the browser. Ask staff to close and reopen Chrome today, or use your management tool or group policy to set a relaunch deadline.
- Check versions centrally. Use your endpoint management, RMM or inventory tool to list Chrome versions across all machines and chase the ones that have not updated.
- Update other Chromium browsers. Check Microsoft Edge, Brave, Opera and Vivaldi for security updates over the coming days and install them when released.
- Look at machines nobody watches. Kiosks, reception PCs, shop-floor and branch computers often miss updates. Check them by hand if needed.
- Keep automatic updates on. Make sure no policy blocks browser updates, and remove old unsupported browser versions.
- Watch official advisories. Follow the Chrome Releases blog and the CERT-In website for any further advice on this flaw.
Browsers are only one layer. Our guide to endpoint security for small business covers the other controls that limit the damage if a flaw is used before you patch.
Frequently Asked Questions
How do I check if my Chrome is updated?
Open Chrome, go to More, then Help, then About Google Chrome. The page shows your version and downloads any pending update. After you click Relaunch, the version should be 157.0.8103.50 or later.
Is Microsoft Edge affected by CVE-2026-125350?
Edge is built on Chromium, the same base as Chrome. The reports advise users of Chromium-based browsers, including Edge, to apply fixes as their vendors release them. Check Microsoft's release notes for Edge and update when the fix is available.
Do we need to do anything if Chrome updates automatically?
Yes. Chrome downloads updates on its own, but the fix applies only after the browser restarts. Make sure users relaunch Chrome, and confirm versions centrally so no machine is missed.
How Affix Center Can Help
Affix Center helps organisations in Mumbai and across India keep browsers, operating systems and applications patched and monitored. Our cyber security services in Mumbai cover vulnerability management and endpoint protection, and our managed IT operations team can push and verify updates across every office and branch. If you need help checking that this Chrome fix has reached all your computers, contact us.