Chrome 157.0.8103.50 and 156.0.8078.96: Fixes Exploited XML Bug

Stable 157.0.8103.50/.51: XML Use-After-Free Flagged as Exploited #

Two of the nine Stable fixes are use-after-free bugs in XML. CVE-2026-125350 (bug 582442907) was reported by an anonymous reporter on 2026-11-06. CVE-2026-125346 (bug 572578603) was reported by Arni Hardarson (Neonix Security) on 2026-10-12. Both are rated High in the Stable notes.

The in-the-wild statement is attached to CVE-2026-125350 alone, and the Stable post states it directly:

Google is aware that an exploit for CVE-2026-125350 exists in the wild.

For Stable users on Windows, Mac and Linux, this is the fact to act on first. The same notes say the update will roll out over the coming days/weeks, so an installed build may not receive the fix immediately after the release is published.

Extended Stable 156.0.8078.96: Eleven Fixes, Four Shared With Stable #

The Extended Stable channel was updated to 156.0.8078.96 for Windows and Mac, and its post lists 11 security fixes, ten rated High and one Medium, in the Extended Stable post. Four of those CVEs also appear in the Stable list with the same bug numbers: CVE-2026-125345, CVE-2026-125346, CVE-2026-125347 and CVE-2026-125350. Both posts carry the publication date 2026-11-09.

The Extended post has no in-the-wild note. The exploit statement appears only in the Stable post, so Extended Stable users should not read it as applying to 156.0.8078.96 unless that channel's notes say so. The other seven Extended items are CVE-2026-121068, CVE-2026-121076, CVE-2026-121095, CVE-2026-121208, CVE-2026-121213 and CVE-2026-121233, all High, and CVE-2026-121184, rated Medium.

WebGL, Compositing and GPU Fixes: Rendering Paths #

Three High-rated Stable fixes sit in the rendering stack. CVE-2026-125345 is an uninitialized resource in WebGL (bug 550525698, reported by Google on 2026-08-21). CVE-2026-125343 is a buffer overflow in Compositing (bug 561998123, reported by Google on 2026-09-15). CVE-2026-125348 is an out-of-bounds write in GPU (bug 563358700, reported by Google on 2026-09-18).

The two Medium-rated fixes are uninitialized resources in GPU: CVE-2026-125349 (bug 536663516, reported by Google on 2026-07-20) and CVE-2026-125342 (bug 566384898, reported by Vo Duc Thang (ugvxb) on 2026-09-26). This suggests that pages and applications using WebGL or GPU-accelerated compositing are the exposed group, since the notes name the components but not the triggers.

V8 Type Confusion and FileSystem Authorization Fixes #

CVE-2026-125344 is a type confusion in V8, rated High, reported by Google on 2026-10-02 (bug 568893995). CVE-2026-125347 is an incorrect authorization in FileSystem, rated High, reported by Google on 2026-09-15 (bug 561996724). CVE-2026-125347 is also listed in the Extended Stable post.

V8 runs the scripts of web pages, so this suggests that the type confusion fix matters to any browsing session, not only to a specific feature. The Stable notes do not tie the V8 bug to a feature, which is why this group is treated here as general browsing exposure.

CVE Identifiers and the Change Each One Belongs To #

Affected and Fixed Versions by Channel #

Both Stable rows describe the same nine fixes, and the Stable notes do not split the count by platform. The Stable Linux build is listed at 157.0.8103.50 without the .51 suffix that the Windows and Mac entry carries.

Update Steps for Stable and Extended Stable Users #

1. On Windows or Mac, update the Stable channel to 157.0.8103.50/.51, as listed in the Chrome Releases Stable post.
2. On Linux, update the Stable channel to 157.0.8103.50.
3. If you run Extended Stable on Windows or Mac, update to 156.0.8078.96, as listed in the Extended Stable post.

How to Confirm Your Chrome Build Has the XML and GPU Fixes #

Compare the installed Chrome version string with the fixed versions in the table above. A Stable install on Windows or Mac should read 157.0.8103.50 or 157.0.8103.51, a Stable install on Linux should read 157.0.8103.50, and an Extended Stable install on Windows or Mac should read 156.0.8078.96. Access to bug details may be kept restricted until most users are updated, so this version comparison is the check the notes support.