Google has released an emergency Chrome update to fix CVE-2026-125350, a high-severity flaw that attackers are already exploiting. It is the eighth Chrome zero-day exploited in the wild this year. If your team works in Chrome, and most teams do, this Chrome zero-day is a simple fix with a real deadline: update every browser today and make sure it restarts.
Here is what Google has confirmed, which versions are safe, and a practical checklist for businesses in the USA and the UAE.
What Google fixed on November 9
On Monday, November 9, 2026, Google pushed a Stable Channel update for desktop Chrome that fixes nine security flaws. One of them, CVE-2026-125350, is a use-after-free bug in Chrome’s XML component, reported by an anonymous researcher on November 6.
Google said it is aware that an exploit for the flaw exists in the wild. It has not shared who is behind the attacks, who was targeted or how the exploit is delivered, and it usually keeps bug details restricted until most users have updated.
What is a use-after-free bug?
A use-after-free happens when a program keeps using a piece of memory after it has already released it. Attackers can shape what ends up in that memory, which can let a booby-trapped web page run malicious code. In plain terms: visiting the wrong page on an unpatched browser could be enough to start an attack.
Which Chrome versions are safe?
- Windows and macOS: Chrome 157.0.8103.50 or .51
- Linux: Chrome 157.0.8103.50
Google says the update rolls out over days or weeks, so do not wait for it to arrive on its own. Chrome downloads updates in the background, but the fix only applies after the browser is restarted. Many staff keep Chrome open for weeks, which is exactly how patched updates sit unused.
Other browsers built on Chromium, such as Microsoft Edge, Brave and Opera, share much of Chrome’s code. Watch for updates from those vendors too and apply them as soon as they appear.
Why this matters for US and UAE businesses
The browser is now the main workplace. Email, CRM, accounting, cloud storage and AI tools all run inside it, often with saved logins. A compromised browser can give attackers a path to all of those.
- Exploited flaws move fast: once a patch is public, attackers can compare old and new code to find the bug. The window between a fix and wider attacks keeps shrinking.
- Mixed device fleets are hard to track: many SMEs in Dubai and across the USA run company laptops, personal devices and shared front-desk PCs side by side, with no single view of browser versions.
- One device is enough: an attacker only needs one unpatched machine with access to company accounts.
Eight exploited Chrome zero-days in one year also sends a wider message: browser updates are not a monthly chore. They are part of daily security hygiene.
How to update Chrome: a checklist for every business
- Update your own browser now. Open Chrome, go to Settings > About Chrome (or type
chrome://settings/helpin the address bar), let it download the update, then click Relaunch. Confirm the version shows 157.0.8103.50 or later. - Tell your team today. Send a short message asking everyone to do the same, including on home and personal devices used for work.
- Force updates centrally. If you manage devices through Google Admin, Microsoft Intune or group policy, push the update and set a relaunch deadline so browsers restart automatically.
- Check your inventory. List every device that accesses company systems and confirm its browser version. Shared PCs and meeting-room machines are often forgotten.
- Update other Chromium browsers. Check Edge, Brave, Opera and any kiosk or embedded browsers your business uses.
- Trim extensions. Remove browser extensions nobody needs. Fewer extensions mean fewer ways in.
- Keep automatic updates on. Make sure no device has updates disabled, and review this again after the next patch.
Our cybersecurity team can audit your devices, set up central browser management and build a simple patching routine that does not depend on staff remembering to restart. For a wider starting point, see our cybersecurity checklist for small businesses in the UAE.
Frequently asked questions
What is CVE-2026-125350?
It is a high-severity use-after-free vulnerability in Chrome’s XML component. Google patched it on November 9, 2026, and says an exploit exists in the wild.
How do I know if my Chrome is updated?
Go to chrome://settings/help. If the version is 157.0.8103.50 or later on Windows, macOS or Linux, you have the fix. If Chrome shows a Relaunch button, click it to finish the update.
Is Microsoft Edge affected?
Edge is built on Chromium, the same open-source base as Chrome, so check Edge’s own update page and install any security update Microsoft releases for this flaw.
Do I need to do anything if Chrome updates automatically?
Yes: restart it. Automatic updates download the fix, but it only takes effect after Chrome relaunches.
Need help keeping every device patched?
TASCO IT Solutions helps businesses in the USA, UAE and Pakistan secure their devices, browsers and cloud apps. Message us on WhatsApp at +971 58 661 3940 or email info@tascoit.com for a quick security check.