What a Chrome Zero-Day Is, and How to Make Sure Your Browser Is Patched

On November 9, 2026, Google pushed out a Chrome update with a short line that security people read very closely: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” In plain English, someone had found a flaw in Chrome and was already using it against real people before the fix existed.

That is what a zero-day is. The good news is that the fix is out. The catch is that many browsers are still running the old, vulnerable code, because Chrome downloads updates quietly and only switches to the new version after a restart.

Here’s what Google’s notice means, why it says so little, and how to check in a minute that your browser is actually patched.

Prefer to watch? Here’s the short version:

What “zero-day” actually means

Software has bugs. Most are found by the company’s engineers or outside researchers and fixed before anyone abuses them. A zero-day is a flaw that attackers know about before the software maker has shipped a fix. The name comes from the developer’s side: they have had zero days to fix it, because the attack is already happening.

Zero-days are valuable because nobody has a defence ready, so attackers tend to use them quietly against chosen targets to keep the flaw secret for as long as possible.

What “exploited in the wild” means

An exploit is the working attack: the code or crafted file that takes a bug and turns it into something useful for an attacker. “In the wild” means out in the real world, used against real users, as opposed to a researcher showing it off in a lab.

So Google is saying it has evidence of real attacks, not that everyone was hit. It has not said who was targeted, how many people, or how.

The US Cybersecurity and Infrastructure Security Agency (CISA) took it seriously too. It added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog on November 10, 2026, and gave US federal agencies until November 24 to patch. According to BleepingComputer, it is the eighth exploited Chrome zero-day Google has patched in 2026. Google doesn’t publish a running count, but CISA’s catalog agrees: it lists eight Chromium-related flaws added during 2026, from a CSS bug in February to flaws in the V8 JavaScript engine, the Skia graphics library and the Dawn WebGPU component. Browsers are attacked constantly because everyone uses them and they process content from strangers all day.

The bug itself: a use-after-free in XML

The official record on the National Vulnerability Database describes it as a “use after free in XML in Google Chrome prior to 157.0.8103.50” that “allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.” Google rated it High severity.

What XML is

XML is a format for structured data, a cousin of the HTML that web pages are written in. The bug sits in the part of Chrome that reads and processes it.

What a use-after-free is

Programs constantly borrow small chunks of memory, use them, and hand them back so the space can be reused. A use-after-free happens when the program hands a chunk back but keeps a note pointing at it, then later follows that old note and uses the memory again.

Think of a hotel. You check out of room 214, but you keep a copy of the key card, and it still works. Meanwhile the hotel gives room 214 to someone else. If you walk back in, you are now handling another guest’s things. In a program, the “new guest” can be data an attacker planted. When the browser reaches back into memory it no longer owns, it treats that data as trusted, and with careful setup the attacker can steer it into running their code.

MITRE, which maintains the standard list of software weakness types, puts it more formally: CWE-416 is when “the product reuses or references memory after it has been freed.” Its common nickname is a “dangling pointer”.

What “inside the sandbox” means

Chrome runs websites in a locked-down process called a sandbox, which limits what code there can touch on your device. So this bug, on its own, gives an attacker a foothold inside that box rather than full control of your computer. Attackers often chain such a flaw with a second bug that breaks out of the sandbox, which is why these still get emergency patches.

The phrase “via a crafted HTML page” is the scary part for ordinary users: the attack is delivered by a web page. Visiting the wrong link could have been enough.

Why Google keeps the details secret

If you click the bug link in Google’s notice, you’ll hit a permission wall. That is deliberate. Google’s release note explains:

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix.”

A patch is a map. Once the fix is public, skilled attackers can compare the old and new code, work out what was broken, and build their own exploit. A full write-up on day one would do that work for them while millions of browsers are still unpatched. Google adds that it will also keep details restricted if the bug lives in a shared library that other projects use but haven’t fixed yet.

The notice does say two reports led to the fix, one dated October 12, 2026 and another on November 6, 2026. That is all the public timeline there is for now.

How Chrome updates, and why you have to relaunch

Chrome checks for updates on its own and downloads them in the background. But it can’t swap out the program while it’s running, so the new version only takes over when the browser restarts. Google’s Chrome help page puts it this way: “Normally updates happen in the background when you close and reopen your computer’s browser.”

Plenty of people never fully close Chrome. They put the laptop to sleep and carry on with the same 40 tabs for weeks, so the fix sits downloaded on the machine, doing nothing. Google also rolls updates out “over the coming days/weeks”, so not everyone gets the download at the same moment.

How to check you’re patched

The fixed versions are 157.0.8103.50 or later for Linux, and 157.0.8103.50/.51 or later for Windows and Mac. Google has released newer builds since (157.0.8103.78 on November 11, and version 158 is rolling out), so if your number is higher, you’re fine.

On a Windows, Mac or Linux computer

1. Open Chrome.
2. Click the three-dot More menu at the top right.
3. Go to Help, then About Google Chrome.
4. Wait a few seconds. Chrome checks for updates while this page is open.
5. If you see a Relaunch button, click it.
6. Check the version number under the “Google Chrome” heading.

Your open tabs and windows come back after the restart. Incognito windows do not, so finish anything you need there first. If there’s no Relaunch button, Google says you’re already on the latest version. On Linux, updates come through your package manager, and on a Chromebook you update the whole operating system.

On Android

Google released Chrome 157.0.8103.50 for Android on November 9, 2026, and says Android releases “contain the same security fixes as their corresponding Desktop releases” unless noted.

1. Open the Play Store.
2. Tap your profile icon at the top right.
3. Tap Manage apps & device.
4. Under “Updates available”, find Chrome and tap Update.

To see which version you have, open Chrome, tap the three-dot menu, then Settings, then About Chrome.

On iPhone and iPad

Chrome on iPhone is built on Apple’s own web engine (Google’s help page refers to Apple’s WKWebView), and Google’s November 9 advisory listed desktop and Android builds only. Keeping it updated is still a good habit:

1. Open the App Store.
2. Tap your profile picture at the top right.
3. Scroll to “Available Updates” and look for Chrome.
4. Tap Update if it’s listed.

Since the engine underneath comes from Apple, it also pays to keep iOS itself up to date in Settings, General, Software Update.

Edge, Brave and Opera need their own updates

Chrome is built on an open-source project called Chromium, and so are Microsoft Edge, Brave, Opera, Vivaldi and others. They share much of the same code, which means they often share the same bugs. Updating Chrome does nothing for them. Each browser ships its own patched build on its own schedule.

• Microsoft Edge: Microsoft’s security release notes say Edge 157.0.4341.46, released November 9, 2026, contains the fix for CVE-2026-125350. Edge for Android got it in 157.0.4341.53 on November 11.
• Brave: Brave’s release notes show version 1.99.56 moved to Chromium 157.0.8103.50 on November 10, 2026.
• Opera and others: check the browser’s own About page or release notes for a build based on Chromium 157.0.8103.50 or later.

In most of them, opening the About page in settings triggers an update check. If it offers a restart, take it.

If you keep a second browser around “just for that one site”, it’s easy to forget it, and a neglected browser with an old engine is exactly what these exploits hunt for. If you’re tidying up your digital life anyway, our guide on finding every account that uses your username is a good next step.

The bottom line

A zero-day is a bug attackers found first. CVE-2026-125350 was one: a memory mistake in how Chrome reads XML, used in real attacks, and fixed by Google on November 9, 2026. Google is keeping the details quiet so copycats can’t build on the patch while people catch up.

Your part is small. Open the About page, let the browser check, and relaunch if it asks. Do it for every Chromium browser you use, and on your phone too. Then let automatic updates do their job, and every so often close the browser properly so they can.

For another look under the hood of everyday tech, see how lidar sees through a jungle canopy. And since your phone needs updates too, here is how to make its battery last longer, both per charge and over the years.