The signal behind the update
Google released a desktop Chrome update on November 9 with nine security fixes and singled out an XML memory-safety flaw, CVE-2026-125350, for which it said an exploit exists in the wild. The company rated the flaw high severity. Its release notice credits two reports, one on October 12 from Neonix Security researcher Arni Hardarson and an anonymous report on November 6. Those dates establish when reports reached Google. They do not date the first use of the exploit.
A second milestone for fleet owners
The Canadian Centre for Cyber Security subsequently recorded that the US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities Catalog on November 10. The catalog entry gives organizations that prioritize known exploitation a reason to move this browser update up the queue even if several other findings carry the same severity rating. Neither notice identifies a particular victim or gives a measure of how widespread exploitation is.
A release date and an installed version
Google identified the new stable builds as 157.0.8103.50 or .51 for Windows and macOS, and 157.0.8103.50 for Linux, and described a rollout over days or weeks. That timetable leaves a meaningful interval between availability and fleet coverage. A report grouped only by device operating system or by whether automatic updates are enabled cannot tell an incident team which browser build was running on a device at a particular time. For an organization investigating activity during that interval, the useful evidence is a dated record of the installed version alongside the release and catalog dates.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
