Google updates Chrome desktop stable channel
According to the official Chrome Releases blog, Google has updated the Chrome desktop stable channel to 157.0.8103.50/.51 (Windows, Mac) and 157.0.8103.50 (Linux), and it will be rolled out gradually over the next several days to several weeks. This update fixes 9 security vulnerabilities, including 7 high-severity and 2 medium-severity issues, involving components such as V8, WebGL, GPU, XML, and FileSystem.
Google said that the known use-after-free vulnerability in the XML component, CVE-2026-125350, has been exploited in the wild. The vulnerability was reported by an anonymous researcher on November 6, 2026.
Original source:
Title: Stable Channel Update for Desktop Publisher: Google Chrome (Chrome Releases) Publication date: 2026-11-09 URL: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html Source nature: official release Verification status: the full original post was actually read for this report. Verification date: 2026-11-10. Supporting content: supports all key facts in the body, including the version numbers, rollout scope and pace, the 9 security fixes (7 high-severity, 2 medium-severity), the components involved, and the fact that CVE-2026-125350 has been exploited in the wild.
ABAB AI Insight
Google explicitly disclosed CVE-2026-125350 as a high-severity use-after-free vulnerability in the Chrome stable release and confirmed that it has been exploited in the wild. This is the eighth zero-day vulnerability in Chrome to be confirmed as under active attack in 2026. The vulnerability is in the XML processing component, and it was reported on November 6, just three days before Google completed the fix and pushed it out, reflecting a rapid response mechanism to high-severity memory safety issues.
This update also fixes six other high-severity vulnerabilities, including another XML use-after-free, a V8 type confusion issue, a GPU out-of-bounds write, and a WebGL uninitialized resource issue, as well as two medium-severity vulnerabilities, covering the browser's core rendering, scripting engine, and graphics stack. Google's usual practice is to restrict disclosure of vulnerability details until most users have finished updating, in order to reduce the exploitation window.
As the browser is the entry point for daily user interactions, XML- and V8-related vulnerabilities are often used to trigger memory corruption through malicious web pages. For users running sensitive extensions such as crypto wallets and password managers, timely updating can reduce the attack surface; users on the Extended Stable channel should pay attention to the corresponding 156.0.8078.96 version.
This kind of zero-day fix is a reminder that browser security updates should take priority over feature iteration. Users can manually check for updates and restart through the Chrome menu under Help - About Google Chrome, rather than relying on delays in automatic rollout.
ABAB News · Cognitive Law
An officially confirmed vulnerability that has been exploited in the wild makes updating first the most direct way to reduce risk.
The interval between vulnerability reporting and fixing was only a few days, showing the browser vendor's response speed to high-severity memory issues.