Google patched nine Chrome flaws on Monday, and one is already being used in real attacks. Updating Chrome on your computer takes about a minute.
Google has released a Chrome update that fixes nine security flaws. One of them is already being used by attackers in the real world. Google says it is aware that an exploit for the flaw exists in the wild. If Chrome is your everyday browser, this update is worth installing today.
The flaw being exploited is tracked as CVE-2026-125350. Google rates it high severity. It is a "use-after-free" bug in a part of Chrome that handles XML, a common format for structured data on websites.
In plain terms, a use-after-free bug happens when a program keeps using a piece of memory after it has been released. That can corrupt data, crash the program, or let an attacker run their own code on the computer. An anonymous researcher reported the flaw on November 6, 2026.
Security people call a flaw like this a zero-day, meaning attackers found a way in before a fix existed. By Google's count, this is the eighth Chrome flaw exploited before a fix this year.
Anyone using Chrome on Windows, Mac or Linux should update. The fixed versions are 157.0.8103.50 or .51 on Windows and Mac, and .50 on Linux. If your Chrome already shows one of those numbers or something newer, you are covered.
Browsers built on the same base as Chrome, called Chromium, may be affected too. That includes Microsoft Edge, Brave, Opera and Vivaldi. Google advises their users to apply fixes as they become available. The source material does not say anything about Chrome on phones.
The alert box above this article lists the exact steps. In short, check your Chrome version, let it finish updating, and restart the browser. The restart matters, because the fix does not take effect until Chrome relaunches.
Google has not said how the flaw is being used in attacks or who is behind them. The severity score is listed as not available. Google also says details may stay restricted until most users have updated. It may keep them hidden longer if other software depends on the same flawed code and has not been fixed yet.
That means the full picture may stay unclear for a while. The fix itself is available now, and it does not depend on those details.
Update Chrome to version 157.0.8103.50 or newer and relaunch it, then update Edge, Brave, Opera or Vivaldi when their fixes arrive.
Ghana's cyber security agency says fake texts using the name TraffiTech-GH are going to drivers. One wrong tap could cost you money or personal details.
Read more: Fake TraffiTech-GH texts target drivers, Ghana cyber agency warnsMessages about an FTC Prime settlement payout are circulating. A real case does not make every message real, so check before you click or pay.
Read more: Prime settlement refund messages: how to tell real from fakeA robocall claims someone tried to change your Venmo password and asks you to press one. Venmo confirms it is a scam, and pressing a key could put your money at risk.
Read more: Fake Venmo password call is a scam. Don't press any number
