If you leave Chrome open for days, the security update you need may be waiting for a restart. On November 9, Google announced a desktop Chrome update that fixes CVE-2026-125350, a flaw for which the company says an exploit exists in the wild.
On November 10, the U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog. The entry describes a memory error in Chromium’s XML component: the browser can try to use memory it has already released. CISA says a specially crafted webpage could let an attacker run code inside the browser’s sandbox, the restricted environment where that code would run. The entry does not say the flaw alone lets an attacker escape that sandbox.
The vulnerability record filed by Google puts the cutoff for the regular release line at 157.0.8103.50. On that channel, the November 9 desktop release listed 157.0.8103.50 and 157.0.8103.51 for Windows and Mac, and 157.0.8103.50 for Linux. Google announced newer stable builds on November 11: 157.0.8103.78 and 157.0.8103.79 for Windows and Mac, and 157.0.8103.78 for Linux, with a gradual rollout. You don’t have to wait for those newer builds to get this particular fix. If you see only “Chrome 157,” check the full number. Google’s separate Extended Stable bulletin lists the same fix in build 156.0.8078.96 for Windows and Mac.
On Windows or Mac, open More → Help → About Google Chrome. Google’s update instructions say Chrome checks for updates on that page. If Relaunch appears, click it, then reopen the About page and read the full version number. On Linux, Google directs users to update through their package manager. Once the update is installed, restart Chrome and check the running version.
CISA’s entry also names Microsoft Edge and Opera as examples of browsers that could be affected because they use Chromium. If you use one of those browsers, check its own vendor’s update guidance. The build numbers in Google’s bulletin are for desktop Chrome.