Google has fixed a Chrome security flaw that it says attackers are already exploiting. The fix for CVE-2026-125350 arrives in Chrome 157. On Android, the patched build is version 157.0.8103.50. It reaches phones through Google Play over the next few days, so check your version and update manually rather than waiting.
What Google has disclosed about the Chrome 157 zero-day
The exploited bug is a use-after-free flaw in Chrome’s XML handling, and Google rates it High severity. It was reported anonymously on November 6. Google shipped the fix on November 9, three days later.
Google’s desktop release notes confirm the attacks in a single line:
“Google is aware that an exploit for CVE-2026-125350 exists in the wild.”
That is as far as Google goes. It keeps bug details restricted until most users have the fix. Google has not said who was targeted, how the attack worked or which platform it hit.
Google says its Android releases carry the same security fixes as the matching desktop builds unless it notes otherwise. The Android release notes mention only stability and performance improvements. Google’s cross-reference to the desktop fixes is what covers the security side.
How to check and update Chrome on Android
Because the Play Store rollout is staged, your phone may not have Chrome 157 yet. Here is how to check, using Google’s own steps.
- Open Chrome, tap More at the top right, then go to Settings > About Chrome.
- Check the version number. If it reads 157.0.8103.50 or later, you have the fix.
- If it is older, open the Play Store app and tap your profile icon at the top right.
- Tap Manage apps & device.
- Find Chrome under Updates available and tap Update.
If Chrome is not in the updates list, the new build has not reached your phone yet. Check again over the next few days.
The staged rollout is the weak spot here. Google is spreading the fix for an actively exploited flaw over several days. Some phones will stay on the vulnerable build in the meantime. Checking manually is the fastest way to close that gap.
The other fixes in Chrome 157
Chrome 157 fixes nine security bugs in total. Google’s list rates seven of them High severity and two Medium. Beyond the exploited flaw, the notable ones are:
- CVE-2026-125346: a second use-after-free bug in XML
- CVE-2026-125344: a type confusion bug in V8, Chrome’s JavaScript engine
- CVE-2026-125348: an out-of-bounds write in the GPU component
- CVE-2026-125343: a buffer overflow in Compositing
Hong Kong’s computer emergency response centre, HKCERT, rates the bulletin as extremely high risk because of the in-the-wild exploit. It lists denial of service, remote code execution and security restriction bypass as possible impacts.
On desktop, the same fixes ship in 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. Google says that rollout runs over the coming days and weeks.
Outdated Chrome builds have caused trouble on phones before. Last week we covered how old Chrome on unpatched Snapdragon phones let attackers steal logins, a separate exploit. While you are updating, also confirm your phone has the November 2026 Android security patch.
Source: Chrome Releases (desktop), Chrome Releases (Android), HKCERT, Google Chrome Help
