Chrome Zero-Day Under Attack: Check Your Version Now

Google has patched a Chrome zero-day that attackers are already using, and the fix is in build 157.0.8103.50. If your Chrome shows a lower number, or you haven’t restarted the browser since Monday, you’re still exposed. The check takes a minute.

There’s a twist for anyone who updated last week. That update isn’t enough, and the reason is in section 3.

⚡ Key takeaways

Google released Chrome 157.0.8103.50/.51 for Windows and Mac, and 157.0.8103.50 for Linux, on Monday, 9 November 2026.
It fixes 9 security flaws. One of them, CVE-2026-125350, has “an exploit in the wild”, in Google’s own words.
Last week’s Chrome 157 build (157.0.8103.38/.39) does not have this fix. Update again and relaunch.
Android got Chrome 157.0.8103.50 the same day through the Play Store.
Only update from Chrome’s own menu or your app store. A website that offers a “Chrome update” file is a scam.

Table of Contents

What the Chrome Zero-Day Is, in Plain Words

A zero-day is a security hole that attackers find and use before the company has a fix ready. That’s the difference between this patch and the routine ones. The bug wasn’t just found by a researcher in a lab. Someone was already using it.

Google’s release note of 9 November lists it as CVE-2026-125350, a “use after free in XML”, rated High. In simple terms, Chrome kept using a piece of memory after it had been released. Bugs of this type can let a specially made web page run code it shouldn’t.

Google added one line that matters most: “Google is aware that an exploit for CVE-2026-125350 exists in the wild.” It hasn’t said who is using it or against whom. Bug details stay restricted until most users have the fix, which is standard practice.

Hong Kong’s cyber agency HKCERT rated the update “Extremely High Risk” in its 10 November bulletin. It says a remote attacker could use these flaws for remote code execution, to bypass security restrictions or to crash the browser.

man at an office desk with two laptops — Office laptops are often left running for days, so a downloaded fix can sit unused. · Photo: World Sikh Organization of Canada / Pexels

How Fast Google Moved, and What Else Got Fixed

The timeline is short. An anonymous researcher reported the flaw on Friday, 6 November. Google shipped the fix on Monday, 9 November. Three days is quick, and it tells you Google treated this as urgent.

The update carries 9 security fixes in all. Here’s the breakdown from Google’s list:

Severity	Count	Parts of Chrome affected
High	7	XML (two flaws), V8, WebGL, GPU, Compositing, FileSystem
Medium	2	GPU

Six of the nine were found by Google’s own teams. A second XML flaw, CVE-2026-125346, was reported in October by an outside researcher. Only CVE-2026-125350 is marked as exploited.

💡 Pro tip

Don’t try to memorise CVE numbers. The only number you need is the build: 157.0.8103.50 or higher on your laptop.

Also readChrome 157 Fixes 213 Security Flaws: Update and Relaunch Today

Updated Last Week? You Still Need This One

This is the catch from the top. Chrome 157 first came out on 3 November with a big batch of fixes, and we covered it in our Chrome 157 update post. Many careful readers updated then and felt done.

That build was 157.0.8103.38 or .39. The zero-day was reported three days later, so that build can’t contain the fix. The version name still says “157”, which is why it’s easy to miss.

So the first two numbers won’t help you. Look at the last one. Anything below .50 on a laptop needs another update.

⚠️ Watch out

Chrome downloads updates quietly, but the new build only starts working after you relaunch the browser. A laptop that just sleeps every night, with 40 tabs open for two weeks, can sit on a downloaded fix without ever using it.

How to Check and Update in One Minute

On a laptop (Windows, Mac, Linux)

Open Chrome and click the three dots at the top right.
Go to Help, then About Google Chrome.
Chrome checks for an update and downloads it.
Click Relaunch.
Open the same page again and read the version. It should say 157.0.8103.50 or higher.

Google’s help page says Chrome saves your open tabs and windows and reopens them after the restart. Incognito windows don’t come back, so finish what’s open there first.

No Relaunch button, and the build is still .38? Google says the rollout happens “over the coming days/weeks”, so it may not have reached you yet. Check the About page again in the evening; opening it triggers a fresh check.

On Android and iPhone

Google released Chrome 157.0.8103.50 for Android on the same day and says it will reach Google Play “over the next few days”. The Android note mentions only stability and performance improvements, and doesn’t name the zero-day. I’d still take the update the moment it shows up.

Android: Play Store → your profile icon → Manage apps & device → Updates available → Chrome → Update.
iPhone: App Store → your profile icon → scroll to Available Updates → Chrome → Update.

While you’re there, check your parents’ phones too. Our phone safety checklist for parents lists the other settings worth fixing in the same sitting.

close view of hands typing on a laptop at a table — The About Google Chrome page shows the exact build you’re running. · Photo: ANTONI SHKRABA production / Pexels

The Fake “Update Chrome” Trap to Avoid

News like this has a side effect. People start searching for “Chrome update”, and scammers know it.

Fake browser-update pages are an old trick that keeps coming back. Malwarebytes documented one campaign in which hacked websites showed a fake error saying Chrome’s automatic update had failed. A ZIP file then downloaded by itself, dressed up as the update. Opening it installed a crypto-miner that also switched off Windows Update and weakened Windows Defender.

The rule is simple, and it’s the same one Malwarebytes gives:

Chrome never needs you to download a file from a website to update.
Updates happen inside the browser (Help → About Google Chrome) or through the Play Store and App Store.
A pop-up on a random site saying “your Chrome is outdated” is not from Google. Close the tab.

Got a WhatsApp forward with a “Chrome security update” link or APK? Delete it. If you think you’ve already installed something odd, run through our is my phone hacked checklist.

Also readIs My Phone Hacked? 9 Checks for Android and iPhone Users

Edge, Brave, Office Laptops: Who Else Should Check

Other Chromium browsers

Edge, Brave, Opera and Vivaldi are built on the same Chromium code as Chrome. They ship fixes through their own update systems, on their own schedules. Google’s build numbers don’t apply to them, so open each browser’s About page and let it check.

Office laptops

If your company manages the laptop, updates may be held back for testing, or you may be on the Extended Stable channel. Security firm Rescana reports the fixed Extended Stable build as 156.0.8078.96 for Windows and Mac. If you see something lower, send your IT team a quick message today. They’d rather hear it from you.

Who should move first

You use Chrome for	Do it
Net banking, trading or tax filing on a laptop	Before your next login
Office email and shared drives	Today
Casual browsing, YouTube	Today, at the next tea break
Only the phone app	When the Play Store or App Store shows the update

✅ Our verdict

Update now, and don’t wait for Chrome to remind you. This is a confirmed attack, the fix is free, and a restart costs you a minute. Check that the build ends in .50 or higher. Then ignore every website and forward that offers to “update Chrome” for you.

Frequently Asked Questions

What is the Chrome zero-day CVE-2026-125350?

It’s a “use after free” memory flaw in the part of Chrome that handles XML, rated High. Google confirmed on 9 November 2026 that an exploit for it exists in the wild, and fixed it in build 157.0.8103.50.

How do I know if my Chrome is safe?

Open the three-dot menu, go to Help, then About Google Chrome. On Windows, Mac or Linux the version should read 157.0.8103.50 or higher. If you see a Relaunch button, click it.

I updated to Chrome 157 last week. Am I covered?

No. The earlier Chrome 157 builds ended in .38 or .39 and came out before this flaw was reported. You need the 9 November build, so update and relaunch once more.

Is Chrome on my phone affected?

Google’s desktop note doesn’t say. It did release Chrome 157.0.8103.50 for Android on the same day, so install it from the Play Store when it appears. iPhone users should take any Chrome update the App Store offers.

Has anyone in India been attacked using this flaw?

Google hasn’t shared who is being targeted or where. As of 10 November, Rescana noted the flaw wasn’t yet on the US agency CISA’s list of known exploited bugs. Nobody outside Google knows the scale, which is one more reason to patch.

The Bottom Line

A Chrome zero-day with a live exploit is the one kind of browser update you shouldn’t postpone. Open Help → About Google Chrome right now, relaunch, and confirm the build ends in .50 or higher. Then do the same on the family laptop that nobody has restarted since Diwali.

Keep reading

Sources

Chrome Zero-Day Is Being Exploited: Check Your Version Today