Google released Chrome 157 for Windows, Mac, Linux and Android on November 9. The update fixes nine security vulnerabilities, seven of them with the severity "High". For the vulnerability CVE-2026-125350, Google says that an exploit has already surfaced, meaning a program that exploits the vulnerability.
The version numbers are 157.0.8103.50 and .51 for Windows and Mac, and 157.0.8103.50 for Linux and Android. Google is rolling out the update gradually over days to weeks. Google does not mention any regional restriction for Germany; the announcement applies worldwide.
What is known about the vulnerability?
The vulnerability CVE-2026-125350 is located in Chrome's XML processing. The bug belongs to the "Use after free" class: Chrome continues to use memory even though it has already been freed. An anonymous person reported the vulnerability to Google on November 6, three days before the update.
According to the Chrome Releases blog, Google is withholding details about the bugs until the majority of users have the update. Google does not provide information about the attackers, affected websites, or the consequences of an attack. The other six vulnerabilities rated "High" are in WebGL, FileSystem, Compositing, GPU, V8, and a second one in XML. The two vulnerabilities rated "Medium" are in the GPU component.
How do you update Chrome?
Chrome usually downloads updates in the background and installs the new version as soon as you close and reopen the browser. If your Chrome has been running for days without a restart, the update is often still waiting to be installed. In the menu with the three dots at the top right, select Help and then About Google Chrome. One click on "Relaunch" installs the version. This path is also described by the Google Chrome Help.
Update Chrome in four steps
On the computer, goal: version 157.0.8103.50 or newer
- Open menuThe three dots at the top right of the browser
- Open pageHelp, then About Google Chrome
- RelaunchOnly the restart installs the update
- Check versionThe number is also shown there
Incognito windows do not come back after the restart
Sources: Google Chrome Help, Chrome Releases
If the page does not show a "Relaunch" button, the current version is already installed. After the restart, Chrome reopens all tabs and windows, but not incognito windows. With "Not now" you postpone the installation until the next restart, which is the worse choice for this update.
Does this also apply to Extended Stable and other browsers?
Yes, for the Extended Stable channel, which Google maintains separately from the regular Stable channel. Google has released version 156.0.8078.96 for Windows and Mac, with 11 security vulnerabilities fixed, including CVE-2026-125350. According to the Chrome Releases blog, the same security fixes apply to Android as for the desktop, and the version is gradually becoming available on Google Play.
Google does not mention Chromium-based browsers such as Edge, Brave or Vivaldi. Whether these browsers have the same vulnerability is for their vendors to clarify. Check the update function there yourself.
What this means for you
Install the update today on every computer you use to manage client projects, accounts, or access to websites, including secondary devices and test machines. Afterwards, check on the About Google Chrome page whether the number is at least 157.0.8103.50.
Before the restart, save open drafts in web tools such as content management systems or design programs in the browser. Chrome restores tabs, but in incognito windows, open entries are lost.
If you look after computers at an agency or club with Extended Stable, compare the number with 156.0.8078.96. For Edge, Brave and Vivaldi, check in the browser settings whether a new version is available.
Google released the update on November 9, 2026.
Sources
