Overview
- Google released emergency Chrome 157 updates on Monday that install versions 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux to patch CVE-2026-125350 and eight other flaws.
- CVE-2026-125350 is a high-severity use-after-free bug in Chrome’s XML component that lets attackers manipulate freed memory to crash the browser, run arbitrary code, or bypass security restrictions when a user visits a crafted webpage.
- India’s CERT-In and Hong Kong’s HKCERT have rated the risk critical or extremely high and urged users to update immediately while avoiding suspicious links and sites until patches are applied.
- Google says exploit code is active in the wild but is withholding technical details until most users are patched; the update is rolling out now but may take days or weeks to reach all Chrome installations and other Chromium-based browsers must wait for vendor patches.
- This is the eighth Chrome zero-day confirmed exploited in 2026, a pattern that increases pressure on browser vendors and leaves users needing faster updates and safer browsing habits to avoid device compromise.