Chrome Updates Stable and Extended Stable for Exploited XML Flaw
Tech GuruQuick Answer
Update the configured Chrome channel to its listed fixed build and relaunch all browser processes. Prioritize review of exposed browser estates for CVE-2026-125350, and retain deployment and version evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record device platform, Chrome channel, installed version, management policy, update availability and application owner. Match Stable and Extended Stable builds separately; Android follows the corresponding Stable announcement. Do not infer that another Chromium-based browser is fixed by a Chrome rollout. Deploy the channel-specific update through supported enterprise or application-store distribution, then relaunch Chrome. Google describes a staged rollout, so verify availability and completion. Check the running browser version after relaunch, test managed sign-in, extensions and critical web applications, and retain deployment failures, exceptions and relevant security telemetry.
Last verified: 2026-11-10 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Google Chrome Stable desktop and Android; Extended Stable desktop |
|---|---|
| Advisory | Chrome-157.0.8103.50 / Chrome-156.0.8078.96 |
| CVEs | CVE-2026-121068, CVE-2026-121076, CVE-2026-121095, CVE-2026-121184, CVE-2026-121208, CVE-2026-121213, CVE-2026-121233, CVE-2026-125342, CVE-2026-125343, CVE-2026-125344, CVE-2026-125345, CVE-2026-125346, CVE-2026-125347, CVE-2026-125348, CVE-2026-125349, CVE-2026-125350 |
| Authoritative release date | November 9, 2026: Extended Stable at 20:45:01 UTC; desktop Stable at 20:52:57 UTC; Android at 23:00 UTC, from the official Atom feed. |
| Authority revision date | Desktop Stable feed updated at 22:53 UTC; Android entry updated at 23:00 UTC on November 9. The notice groups these channel-specific releases. |
| Affected versions | Chrome installations on the named channels requiring these security updates. Google does not publish a universal lower affected-version boundary. The Stable and Extended Stable CVE sets differ; the linked release notes control each channel. |
| Fixed version | Stable Windows/Mac: 157.0.8103.50/.51; Stable Linux/Android: 157.0.8103.50; Extended Stable Windows/Mac: 156.0.8078.96 |
| CVSS base score | Not provided by the authority |
| CVSS severity | High (Google impact for the exploited flaw; CVSS severity not provided) |
| Exploitation status | Google confirms an in-the-wild exploit for CVE-2026-125350. No exploitation claim is made for the other listed CVEs.; no exploitation claim is inferred. |
What Changed
Google released nine Stable security fixes and eleven Extended Stable fixes and confirmed an in-the-wild exploit for XML use-after-free CVE-2026-125350. The Android announcement states that its release carries the corresponding desktop security fixes unless otherwise noted.
What To Validate Now
- Inventory. Record device platform, Chrome channel, installed version, management policy, update availability and application owner.
- Establish applicability. Match Stable and Extended Stable builds separately; Android follows the corresponding Stable announcement. Do not infer that another Chromium-based browser is fixed by a Chrome rollout.
- Remediate. Deploy the channel-specific update through supported enterprise or application-store distribution, then relaunch Chrome. Google describes a staged rollout, so verify availability and completion.
- Validate. Check the running browser version after relaunch, test managed sign-in, extensions and critical web applications, and retain deployment failures, exceptions and relevant security telemetry.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not switch browser channels as an untested shortcut. The release notes supply High and Medium impact labels but no CVSS base score. Investigation should follow observed exposure and telemetry, rather than assume every managed endpoint was compromised.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
- Authoritative source: https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html
- Authoritative source: https://chromereleases.googleblog.com/2026/11/extended-stable-update-for-desktop_0910980127.html
- Authoritative source: https://chromereleases.googleblog.com/2026/11/chrome-for-android-update_01533302390.html
Channel-Specific CVE Scope
- Channel release: CVE-2026-125342, CVE-2026-125343, CVE-2026-125344, CVE-2026-125345, CVE-2026-125346, CVE-2026-125347, CVE-2026-125348, CVE-2026-125349, CVE-2026-125350
- Channel release: CVE-2026-121068, CVE-2026-121076, CVE-2026-121095, CVE-2026-121184, CVE-2026-121208, CVE-2026-121213, CVE-2026-121233, CVE-2026-125345, CVE-2026-125346, CVE-2026-125347, CVE-2026-125350
- Channel release: Android inherits the corresponding desktop Stable fixes unless otherwise noted.
