Chrome Zero-Day Exploited in Attacks: Update to Chrome 157 Now

Google has released an emergency Chrome update to fix a zero-day flaw that attackers are already exploiting. If you or your staff use Chrome on Windows, Mac or Linux, this is an update to install today, not next week. This article explains what was fixed, who is affected, and how to make sure every browser in your home or office is protected.

What happened

On Monday, 9 November 2026, Google pushed Chrome version 157.0.8103.50/.51 to the Stable channel for Windows and Mac, and 157.0.8103.50 for Linux. The update fixes nine security problems. According to security outlets reporting on Google’s advisory, the most serious is CVE-2026-125350, a “use-after-free” bug in the part of Chrome that handles XML data, and Google says it is aware that an exploit for this flaw exists in the wild.

The bug was reported to Google by an anonymous researcher on 6 November, which means Google turned around a fix in about three days. That speed is a strong signal of how seriously the company is treating it.

What a use-after-free bug means

A use-after-free happens when a program keeps using a piece of memory after it has already released it. A skilled attacker can arrange for their own data to land in that freed memory, and then trick the program into running it. In a browser, this kind of flaw is often triggered simply by opening a booby-trapped web page. That is why browser zero-days are so valuable to criminals and spyware operators: the victim does not need to download or install anything.

What Google has not said

Google has not shared who is behind the attacks, who has been targeted, or how the malicious pages are being delivered. This is normal practice. The company usually keeps bug details restricted until most users have updated, so that other attackers cannot copy the technique from the fix.

The other flaws fixed in Chrome 157

The same update closes eight more security holes. Google has not reported that any of these are being exploited, but several are rated high severity, so they add to the case for updating quickly. Reported fixes include:

• A second use-after-free bug in XML handling (CVE-2026-125346).
• A type confusion bug in V8, Chrome’s JavaScript engine (CVE-2026-125344).
• A buffer overflow in Compositing, the code that draws page layers on screen.
• An out-of-bounds write in GPU code.
• An incorrect authorization issue in the FileSystem component.
• Three uninitialized resource bugs in WebGL and GPU code.

Bugs in V8 and graphics code are favourite targets for attackers because they can sometimes be chained together with other flaws to escape Chrome’s security sandbox.

Who is affected

Anyone running Chrome on a desktop or laptop older than the versions above is exposed. That includes home users, schools, cybercafés, banks, fintechs and small businesses across Nigeria and the rest of Africa, where Chrome is the most widely used browser on PCs.

Other browsers built on the Chromium engine, such as Microsoft Edge, Brave and Opera, share much of Chrome’s code. Their makers ship their own fixes on their own timelines, so users of those browsers should watch for updates over the coming days rather than assume they are already protected.

Why the “rolling out” message matters

Google says the update will roll out “over the coming days/weeks”. In practice, that means many computers will not receive it automatically right away. A browser that has been left open for days may also have downloaded the update but not applied it, because Chrome only finishes updating when it restarts. For an exploited bug, you should not wait for the rollout to reach you.

How to update Chrome now

1. Open Chrome and click the three-dot menu in the top-right corner.
2. Go to Help, then About Google Chrome. (You can also type chrome://settings/help in the address bar.)
3. Chrome will check for updates and download the new version.
4. Click Relaunch. Your open tabs will reopen, but save any unfinished work in web forms first.
5. Go back to About Google Chrome and confirm the version starts with 157.0.8103.50 or higher.

If the About page says Chrome is up to date but shows an older version, wait a few minutes and check again, or restart the computer.

Advice for businesses and IT teams

In an office, the real risk is the one machine nobody checks: the reception PC, the accounts laptop that is never restarted, or a shared computer in a training room. A few steps help close those gaps:

• Do a quick walk-round or remote check. Confirm the Chrome version on every computer, not just your own.
• Force a restart. If you manage Chrome centrally through Google Admin console or Windows Group Policy, use your relaunch notification settings to require a browser restart within a short window.
• Check other Chromium browsers. List which browsers are installed on staff PCs and track updates for each one.
• Do not forget kiosks and display screens. Machines used for dashboards, point-of-sale screens or digital signage often run Chrome unattended and are easy to overlook.
• Remind staff about links. Until every device is updated, be extra careful with unexpected links in email, WhatsApp and SMS.

What you should do

• Update Chrome to 157.0.8103.50 or later on every Windows, Mac and Linux computer today, then relaunch the browser.
• Check the version number afterwards instead of assuming the update was applied.
• Update Edge, Brave, Opera and other Chromium-based browsers as soon as their makers release fixes.
• Turn on automatic updates and restart your browser at least once a week so future emergency fixes apply quickly.
• If a computer behaved oddly after visiting an unfamiliar site in recent days, run a full security scan and change passwords for important accounts from a clean device.

Sources

• Chrome Releases: Stable Channel Update for Desktop (9 Nov 2026)
• SecurityOnline: Chrome Zero-Day CVE-2026-125350 Exploited
• GBHackers: Google Chrome Zero-Day Vulnerability Exploited in the Wild

Featured image: Photo: “PSP Web Browser” by wyzik, CC BY 2.0, via Openverse — source