Google's November 9 Chrome Stable release fixes nine security flaws. Google reports that an exploit for CVE-2026-125350, a high-severity use-after-free flaw in XML processing, exists in the wild. This is confirmed exploitation information for that CVE, not a claim that every flaw in the release is being exploited.
For the Stable desktop channel, the update is 157.0.8103.50/.51 on Windows and Mac and 157.0.8103.50 on Linux. Organizations should promptly deploy the applicable supported update after appropriate testing, relaunch Chrome, and verify the installed version across their devices. Google notes that rollout may take days or weeks.
MS-ISAC advisory 2026-127 warns that the most serious flaws could let attackers run code with the logged-in user's privileges. Using a standard account rather than an administrator account can reduce the impact of a successful attack.
This summary concerns the Stable desktop channel. Managed organizations using other release channels should consult Google's current release guidance for their channel rather than assume the Stable version applies.
Sources: Google Chrome Releases, November 9, 2026: chromereleases.googleblog.com/2026/11/stable-channel-update-…
Attribution: MS-ISAC TLP:CLEAR advisory 2026-127, issued November 10, 2026.