Summary
- Chrome's 9 November update fixes nine security issues including actively exploited CVE-2026-125350.
- The exploited weakness is a high-severity use-after-free flaw in Chrome's XML processing functionality.
- NHS England warned further exploitation was likely, and CISA added the issue to its Known Exploited Vulnerabilities catalogue on 10 November.
Google has released a security update for Chrome after confirming that attackers have exploited a high-severity memory safety vulnerability in the browser’s XML processing functionality.
The flaw, CVE-2026-125350, is among nine security issues addressed in Chrome’s Stable channel update published on 9 November. Google confirmed the existence of an exploit in the wild but has not publicly identified the attackers, affected organisations or circumstances of exploitation.
Chrome has been updated to versions 157.0.8103.50 and 157.0.8103.51 for Windows and macOS, and 157.0.8103.50 for Linux, with rollout taking place across affected platforms.
NHS England issued a cybersecurity alert on 10 November, identifying the exploited weakness and assessing further exploitation as likely. The US Cybersecurity and Infrastructure Security Agency also added CVE-2026-125350 to its Known Exploited Vulnerabilities catalogue on the same day.
The issue is described as a use-after-free weakness. Such defects arise when software attempts to use memory after its associated object has been released, creating conditions that can undermine the application’s intended memory protections.
The precise consequences depend on the affected code and how an attacker reaches it. Google’s public bulletin does not provide sufficient detail to establish the full exploitation sequence or confirm that every successful attempt results in the same outcome.
Nine vulnerabilities addressed in desktop release
Other high-severity flaws addressed by the update involve several browser components, including WebGL, FileSystem functionality, compositing, GPU processing and Chrome’s V8 JavaScript engine.
The collection includes resource-handling issues, a buffer overflow, an out-of-bounds write and a type confusion weakness. A separate high-severity use-after-free issue affects XML functionality, while two medium-severity findings concern graphics-related components.
Modern browsers execute untrusted web content while interacting with files, graphics hardware, scripting engines and operating-system services. Different weaknesses can therefore undermine separate security boundaries and have different prerequisites.
Google has not stated that all nine vulnerabilities are actively exploited. Its exploitation confirmation concerns CVE-2026-125350; the remaining corrections should not be described as part of the same confirmed attack campaign.
The company has limited access to some technical details while the corrected software reaches more users. That restriction can reduce the amount of information available for constructing attacks against installations that remain unpatched.
Managed browser estates require verification
Chrome is widely deployed on enterprise workstations, where browsers provide access to identity providers, software services, internal portals and administrative systems.
A browser compromise can consequently create exposure even if the underlying web application has not itself been breached. The browser processes material from remote services within a user session that may already hold authenticated access to business systems.
The degree of risk depends on the vulnerability, Chrome’s sandboxing protections and endpoint configuration. The advisory does not establish whether additional flaws must be combined with CVE-2026-125350 to obtain particular forms of system access.
Enterprise update management adds complexity because deployments can be controlled through central policy, application packaging and scheduled maintenance windows.
Although Chrome normally distributes updates automatically, availability does not guarantee that every managed installation has installed and activated a corrected build. Devices can remain on earlier versions because of delayed restarts or deployment controls.
Google has separately released updates for the Extended Stable desktop channel on Windows and macOS. Organisations using that channel must consult its distinct version information rather than assume that Stable channel release numbers apply.
NHS England identifies affected builds preceding the corrected releases and directs organisations to the Google release documentation. Its alert does not establish the number of attacks or identify victims.
The November vulnerabilities are separate from Chrome corrections made in October. The existence of an exploited issue distinguishes the latest update from a routine collection of potential weaknesses.
Google has not attributed the exploitation to a particular threat actor or stated whether the observed activity was narrowly targeted or widespread. Corrected builds are available across the principal desktop operating systems, while both NHS England and CISA have identified the exploited issue for attention.
