Chrome zero-day exploited: update and relaunch now
Google fixed an exploited Chrome flaw on November 9. Which version you need, why the update is not active until Chrome restarts, and what offices should check.
Google released an emergency Chrome update on Monday, November 9, 2026, to fix CVE-2026-125350, a flaw that attackers are already using. On November 10 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of known exploited vulnerabilities. If your staff use Chrome, and most offices do, this is one to check today rather than leave to chance.
What was fixed
According to Google's Chrome Releases blog, the update moves desktop Chrome to version 157.0.8103.50 or .51 on Windows and Mac, and 157.0.8103.50 on Linux. The flaw is a high-severity "use-after-free" bug in the part of Chrome that handles XML. Google says it is aware that an exploit for it exists in the wild, and it is keeping technical details restricted until most users have updated.
BleepingComputer reports that this is the eighth Chrome zero-day exploited in attacks this year. The Hacker News notes that the public description says a crafted web page could run code inside Chrome's sandbox, and that federal agencies have until November 24 to patch. Google has not said who is behind the attacks or who has been targeted.
Why "Chrome updates itself" is not enough
Chrome downloads updates in the background, but the fix only takes effect once the browser is closed and reopened. Many people leave Chrome open for days or weeks with dozens of tabs, so a computer can have the update waiting and still be running the vulnerable version. In a small office, that is usually the gap.
What to do in your office
- Check each computer. In Chrome, open the menu, then Help, then About Google Chrome. It will fetch the update if needed. Click Relaunch, and confirm the version shown is 157.0.8103.50 or later.
- Ask staff to relaunch, not just update. A short message such as "please restart Chrome before lunch" closes the gap faster than waiting for people to reboot. Chrome reopens tabs after a relaunch.
- Don't forget the laptops that are out of the office and any shared or front-desk computers that nobody signs in to every day.
- Update other Chromium-based browsers such as Microsoft Edge, Brave or Opera as their makers release fixes. They share much of Chrome's code, so check each one's About page over the next few days.
- If you manage computers centrally, confirm in your management console that devices report the new version, and consider setting a relaunch deadline policy so browsers cannot stay out of date for long.
The bigger lesson
Browser flaws like this one are attractive to attackers because a single visit to a booby-trapped page can be enough. The defence is boring but effective: updates applied quickly, and someone checking that they actually landed. It arrived the same week as the Outlook zero-day fixed in November's Patch Tuesday.
If keeping track of updates across every computer is falling through the cracks, our patch management service handles operating system, browser and application updates and reports what is still outstanding, as part of our managed IT services. Call (213) 986-4855 to talk it through.