Overview
- Google released Chrome 157 on Monday to fix nine vulnerabilities and is distributing versions 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux and Android.
- One patched flaw, CVE-2026-125350, is a high‑severity use‑after‑free bug in Chrome’s XML component that can let an attacker run code inside the browser sandbox or crash the browser.
- Google says an exploit for CVE-2026-125350 is being used in the wild and is keeping technical details restricted until a majority of users receive the update to reduce further abuse.
- India’s CERT-In rated the issue critical in advisory CIVN-2026-0544 and urged immediate updates, while U.S. agency CISA had not yet added the CVE to its Known Exploited Vulnerabilities catalog at the time of reporting.
- This is the eighth Chrome zero-day confirmed as actively exploited in 2026, which raises risk for Chrome’s global user base and means users should update now and watch for patches from other Chromium-based browser vendors.