Google released a Chrome update on 9 November that fixes nine security issues, including CVE-2026-125350, a vulnerability that attackers were already using. It is the eighth exploited Chrome zero-day patched this year.
What is known
The fixed versions are 157.0.8103.50 and .51. Google has confirmed exploitation but, as usual, is holding back technical detail until most users have updated. Reports disagree on which browser component is involved, so that detail should wait for Google’s own write-up.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 10 November.
What to do
- Open the browser menu, go to Help, then About Google Chrome, let it update, and restart. The fix is not active until the restart.
- Update other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as their vendors release the fix.
- In managed environments, enforce a relaunch deadline so the update is not left pending for weeks.
Why eight in a year matters
Browser zero-days are a dependable way into an organisation, because the browser is the one application nearly everyone uses to open untrusted content. The defence is speed: the shorter the time between release and restart, the smaller the window.
For OT environments
Operator and engineering stations often carry a browser for vendor portals or web-based HMIs, and it is rarely updated. Either keep it current or restrict it to the internal addresses it actually needs.