If Chrome is how your team reaches customer admin portals, verify the browser that is actually running. Google released fixes for CVE-2026-125350 on November 9, 2026 and confirmed that an exploit exists in the wild.
Vendor severity High. Suggested MSP priority Urgent where Chrome is below its channel’s fixed build, especially on workstations used for Microsoft 365, Entra, or RMM administration. Last verified November 10, 2026.
What Google confirmed
CVE-2026-125350 is a use-after-free in Chrome’s XML handling. Google’s public notes give fixed builds by channel. A complete affected-version range, attack prerequisites, CVSS score, workaround, and vendor-directed compromise checks or credential rotation could not be verified. The CVE was absent from the CISA KEV catalog checked on November 10, so there is no KEV federal deadline in that catalog.
Fixed builds by channel
- Stable for Windows and macOS 157.0.8103.50 or 157.0.8103.51.
- Stable for Linux 157.0.8103.50.
- Extended Stable for Windows and macOS 156.0.8078.96.
- Chrome for Android 157.0.8103.50. Google says it inherits the corresponding desktop security fixes unless noted otherwise.
Use these as rollout floors for the listed channels. Google stages availability. The cited notices establish Chrome fixes, and Edge, WebView2, ChromeOS, iOS and Android System WebView require separate vendor mapping.
What to do across customers
- Inventory installed Chrome, platform, channel and running build across customers. Start with privileged workstations. Check target-version pins, update suppression and devices that rarely check in.
- If compromise is suspected, use your endpoint response process to isolate the device and preserve evidence. Review associated browser, endpoint and privileged sign-in activity.
- Roll out the applicable update using your existing management tooling, then fully relaunch Chrome. Check About Google Chrome and fleet inventory for the running build and track exceptions through closure.