Google has released an emergency Chrome update to fix a zero-day flaw that attackers are already exploiting. If you or your staff use Chrome on Windows, Mac or Linux, this is an update to install today, not next week. This article explains what was fixed, who is affected, and how to make sure every browser in your home or office is protected.<\/p>\n
On Monday, 9 November 2026, Google pushed Chrome version 157.0.8103.50\/.51<\/strong> to the Stable channel for Windows and Mac, and 157.0.8103.50<\/strong> for Linux. The update fixes nine security problems. According to security outlets reporting on Google\u2019s advisory, the most serious is CVE-2026-125350<\/strong>, a \u201cuse-after-free\u201d bug in the part of Chrome that handles XML data, and Google says it is aware that an exploit for this flaw exists in the wild.<\/p>\n The bug was reported to Google by an anonymous researcher on 6 November, which means Google turned around a fix in about three days. That speed is a strong signal of how seriously the company is treating it.<\/p>\n A use-after-free happens when a program keeps using a piece of memory after it has already released it. A skilled attacker can arrange for their own data to land in that freed memory, and then trick the program into running it. In a browser, this kind of flaw is often triggered simply by opening a booby-trapped web page. That is why browser zero-days are so valuable to criminals and spyware operators: the victim does not need to download or install anything.<\/p>\n Google has not shared who is behind the attacks, who has been targeted, or how the malicious pages are being delivered. This is normal practice. The company usually keeps bug details restricted until most users have updated, so that other attackers cannot copy the technique from the fix.<\/p>\n The same update closes eight more security holes. Google has not reported that any of these are being exploited, but several are rated high severity, so they add to the case for updating quickly. Reported fixes include:<\/p>\n Bugs in V8 and graphics code are favourite targets for attackers because they can sometimes be chained together with other flaws to escape Chrome\u2019s security sandbox.<\/p>\n Anyone running Chrome on a desktop or laptop older than the versions above is exposed. That includes home users, schools, cybercaf\u00e9s, banks, fintechs and small businesses across Nigeria and the rest of Africa, where Chrome is the most widely used browser on PCs.<\/p>\n Other browsers built on the Chromium engine, such as Microsoft Edge, Brave and Opera, share much of Chrome\u2019s code. Their makers ship their own fixes on their own timelines, so users of those browsers should watch for updates over the coming days rather than assume they are already protected.<\/p>\n Google says the update will roll out \u201cover the coming days\/weeks\u201d. In practice, that means many computers will not receive it automatically right away. A browser that has been left open for days may also have downloaded the update but not applied it, because Chrome only finishes updating when it restarts. For an exploited bug, you should not wait for the rollout to reach you.<\/p>\n If the About page says Chrome is up to date but shows an older version, wait a few minutes and check again, or restart the computer.<\/p>\n In an office, the real risk is the one machine nobody checks: the reception PC, the accounts laptop that is never restarted, or a shared computer in a training room. A few steps help close those gaps:<\/p>\nWhat a use-after-free bug means<\/h3>\n
What Google has not said<\/h3>\n
The other flaws fixed in Chrome 157<\/h2>\n
\n
Who is affected<\/h2>\n
Why the \u201crolling out\u201d message matters<\/h3>\n
How to update Chrome now<\/h2>\n
\n
Advice for businesses and IT teams<\/h2>\n
\n
What you should do<\/h2>\n
\n
Sources<\/h3>\n