Daily · Article 01 · 3 min read
- Security
A Chrome flaw was exploited. Here’s how to check the fix on your PC
Google advisory dated November 9 · CISA catalog updated November 11 at 04:03 JST
Summary
Chrome’s desktop fix is rolling out. Here’s how to check the running version and see whether you need to relaunch.
Key facts
If you use Chrome, open Help → About Google Chrome from its menu. If you see Relaunch, save any work before using it to apply the update. In an advisory dated November 9, Google said vulnerability CVE-2026-125350 had been exploited and announced a phased rollout of the fix. CISA, the US cybersecurity agency, included it in the catalog updated at 04:03 JST on November 11. That timestamp refers to the catalog update. Google release notice CISA catalog
1. The part of the browser that reads a page
Before showing a web page, Chrome reads and interprets its contents. XML is a format for marking the roles of data, such as a title or item in a document. Google described a flaw in Chrome’s XML processing where it referred to workspace it had already released. Imagine a clerk who returns a locker but still treats its contents as their own. In the browser, the assumption that the old data is still there can likewise break normal processing.
| Question | What the public sources establish |
|---|---|
| Affected part | Chrome’s XML processing. Google rated the flaw High |
| Exploitation | Google reported exploitation in the wild and CISA listed the flaw |
| Individual devices | The notices do not establish whether a specific device was affected. The cited notices do not detail the attack path or its scale |
- Question
Affected part
- What the public sources establish
- Chrome’s XML processing. Google rated the flaw High
- Question
Exploitation
- What the public sources establish
- Google reported exploitation in the wild and CISA listed the flaw
- Question
Individual devices
- What the public sources establish
- The notices do not establish whether a specific device was affected. The cited notices do not detail the attack path or its scale
The cat asks Q&A
The researcherDoes a listing mean my own computer was hit?
Pocket NotebookThe listing shows that the flaw has been exploited. You need evidence from your own device to determine its history. Start by checking whether the browser now running contains the fix.
2. From Google’s release to the version on your PC
Once Google publishes a fixed version, Chrome checks whether the update is available for the device. An update can be ready while an older browser window remains open, so a relaunch may still be needed. Follow the arrows to see what the release notice establishes and what to check on your device.
%% Desktop update flow · explanatory diagram based on Google’s release and help pages
flowchart TD
A["Google · Fixed build released"] --> B["Chrome · Phased rollout"]
B --> C["Your PC · Verify the running version"]The cat asks Q&A
- The researcher
Google released the update. Did my open Chrome window already switch?
Pocket NotebookIf
About Google ChromeoffersRelaunch, there’s still a step to apply the update. Reopen the same screen afterward to see which version is running.
3. Why two Chrome installations can show different versions
Stable is the channel that delivers production updates. Organizations may use Extended Stable, another production channel with a different update cadence. These were the versions listed with this fix. If a newer build is available, check the latest release for the channel your device uses.
| Installation | Fixed version in the advisory | Where to check |
|---|---|---|
| Windows or Mac, regular Stable | 157.0.8103.50 or 157.0.8103.51 | Stable notice and About Google Chrome |
| Linux, regular Stable | 157.0.8103.50 | Stable notice and the distribution package or running version |
| Windows or Mac, Extended Stable | 156.0.8078.96 | Extended Stable notice and your IT team’s rollout records |
- Installation
Windows or Mac, regular Stable
- Fixed version in the advisory
- 157.0.8103.50 or 157.0.8103.51
- Where to check
- Stable notice and
About Google Chrome
- Installation
Linux, regular Stable
- Fixed version in the advisory
- 157.0.8103.50
- Where to check
- Stable notice and the distribution package or running version
- Installation
Windows or Mac, Extended Stable
- Fixed version in the advisory
- 156.0.8078.96
- Where to check
- Extended Stable notice and your IT team’s rollout records
The cat asks Q&A
- The researcher
If my version starts with 156, is it automatically out of date?
Pocket NotebookThe Extended Stable fix also starts with 156. On a managed computer, ask IT which channel it uses, which full version was applied, and whether a relaunch is still pending.
To close
What to check after reopening Chrome
On a personal computer, read the full version under About Google Chrome after relaunching. On a work computer, match it to the version in your IT team’s records. That check establishes whether the known fix is running now. Ask your security team separately if you need to investigate past activity on the device.
Sources
- Google desktop Stable updatechromereleases.googleblog.com
- CISA Known Exploited Vulnerabilities Catalogcisa.gov
- Google Extended Stable updatechromereleases.googleblog.com
- Google Chrome update helpsupport.google.com