[Google Releases Emergency Chrome Security Update: Fixes Zero-Day Vulnerability Already Exploited in the Wild, Urges Users to Upgrade Immediately] BlockBeats reports that on November 10th, Google released an emergency stability channel update for the desktop Chrome browser on November 9th, 2026, fixing nine security flaws, including a zero-day vulnerability already being exploited in the wild. This update pushes the Chrome version on Windows and Mac to 157.0.8103.50/.51, and on Linux to 157.0.8103.50, with rollouts planned for the coming days and weeks. The core focus of this update is the high-risk vulnerability CVE-2026-125350, a use-after-free vulnerability in XML components. Google stated in its announcement that it is "aware of the wild exploitation of CVE-2026-125350," but did not disclose the specific attack method, scale of the damage, or the origin of the attack. The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days after Google released a patch. Of the nine patches, seven were classified as "high-risk" and two as "medium-risk." Besides CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also concerns the use-after-release of XML components. It was reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an exploitable vulnerability in the wild. Other high-risk vulnerabilities include uninitialized WebGL resources, improper FileSystem authorization, compositor buffer overflows, GPU out-of-bounds writes, and V8 type obfuscation, most of which were discovered by Google's internal security teams. Google also confirmed that the Android version of Chrome (157.0.8103.50) released on the same day includes the same security fixes as the desktop version, without exception. Users using the Extended Stable channel should install the separate update released on November 9th, version 156.0.8078.96 for Windows and Mac, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Incident Response Center (GovCERT.HK) issued a security alert on the same day, identifying affected systems as versions of Chrome prior to 157.0.8103.50, and stating that successful exploitation of the vulnerability could lead to remote code execution, denial of service, tampering, or bypassing of security restrictions. The Hong Kong Computer Incident Response Center (HKCERT) rated the risk level of this update as "extremely high risk." Google stated in its announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check for and trigger updates via "Settings → About Chrome," and restart their browser after the update for the patch to take effect. For users still running Chrome versions prior to 157.0.8103.50, the immediate priority is to confirm the version number and restart immediately to complete the upgrade. [Original Link]