Chrome zero day update: how to install the fix for flaw No. 8

On Windows, Mac or Linux, the quickest route is Chrome’s own About page, which checks for new versions as soon as you open it. Chrome normally updates quietly in the background when you close and reopen it, so the people most at risk are those who leave the browser open for days.

1. Open Chrome.
2. Click the three-dot More menu in the top right corner.
3. Choose Help, then About Google Chrome.
4. Wait a few seconds while Chrome checks for updates and downloads anything new.
5. Click Relaunch. If there is no Relaunch button, you are already on the newest version.

Google says the browser saves your open tabs and windows and brings them back by itself after the restart. Incognito windows are the exception, so finish anything private first. If you pick Not now, the update simply waits until the next time you restart Chrome.

Extra steps for Windows, Mac, Linux and Chromebook

• Windows: close every Chrome window and tab, then open Chrome again so the update applies.
• Mac: if Chrome sits in your Applications folder, the About page offers an option to update Chrome automatically for every user on that computer.
• Linux: Chrome updates come through your package manager, so run your usual system update.
• Chromebook: Chrome is part of ChromeOS, so you update the browser by updating the Chromebook itself.

The fixed builds belong to Chrome 157 and started rolling out on Monday. Google warns that updates can take days or weeks to reach everyone automatically, but checking by hand pulls them in right away, which is why the manual check above matters this week.

The flaw is a use-after-free bug, a common and dangerous class of memory mistake. Here is the simple version: when Chrome processes XML, a format websites use to describe structured data, it deletes a piece of data from memory but keeps a pointer to the spot where that data used to be. If the browser later goes back to that freed spot, an attacker who has carefully arranged what sits there can corrupt memory, crash the browser or run their own code.

Google rates it high severity. An anonymous security researcher reported it on November 6, and Google shipped the patch just days later. Google confirmed it knows an exploit for CVE-2026-125350 is being used in the wild, but it has not said who is behind the attacks or who the targets are.

That silence is standard practice. Google says it keeps bug details locked away until most people have the fix, and longer if the flawed code sits in an outside library that other software also relies on and has not patched yet. In other words, the less Google says, the more reason there is to update before the details leak out.

A zero-day is a security hole that attackers start using before the software maker has a fix ready, leaving defenders zero days of warning. Chrome has now had eight of them in 2026, and Google patched eight more in 2025. Many of those earlier ones were found by Google’s Threat Analysis Group, the team that tracks hacking campaigns, including ones run with commercial spyware.

The 2026 list shows how many different corners of a browser can go wrong:

• V8, Chrome’s JavaScript engine: four of the eight, including a June out-of-bounds bug and a pair of flaws fixed in September (CVE-2026-85046 and CVE-2026-87491).
• Graphics code: a Skia drawing library flaw (CVE-2026-3909) patched in March, plus an April bug in Dawn, the code behind the WebGPU graphics standard (CVE-2026-5281).
• CSS fonts: CVE-2026-2441 in mid-February, the first exploited Chrome bug of the year.
• XML: this week’s CVE-2026-125350.

Monday’s update also fixes eight other bugs that were not under attack: six high-severity issues spread across the browser’s V8, GPU, XML, compositing, WebGL and file system code, and two medium-severity GPU problems. Google says it found most of them itself. That release arrived only days after Chrome 157 first landed with 213 security fixes, seven of them rated critical, so a browser that has not restarted in a while may be missing both rounds of fixes.

Google’s advisory names the desktop versions for Windows, Mac and Linux. It does not list Android or iPhone builds for this flaw, but Chrome on phones updates through the app stores, and checking takes seconds.

Updating Chrome on Android

1. Open the Play Store app.
2. Tap your profile icon in the top right corner.
3. Tap Manage apps & device.
4. Look for Chrome under the updates that are available and tap Update.

Updating Chrome on iPhone and iPad

1. Open the App Store.
2. Tap your profile picture at the top right.
3. Scroll to the list of pending updates and look for Chrome.
4. Tap Update if it appears.

Edge, Brave, Opera and Vivaldi are built on Chromium, the same open-source code as Chrome. Security researchers advise users of those browsers to install the matching fixes as each company releases them. Check each browser’s About page or update settings over the coming days.

One catch for older hardware: Google only supports current Chrome on reasonably recent systems. On a computer, that means Windows 10 or later on Intel chips, Windows 11 on ARM chips and macOS 13 Ventura or later on a Mac. Phones need Android 10 or later, while iPhones and iPads need iOS 18 or later. If your device sits below those lines, Google does not list it as supported for current Chrome.

Google hasn’t shared how the attacks reach victims, whether they need you to visit a booby-trapped page, or how widely the exploit has spread. As of Monday, CISA, the US cybersecurity agency, had not yet added CVE-2026-125350 to its Known Exploited Vulnerabilities catalog, its public list of security holes known to be under attack.

Until more details come out, the practical advice is simple: restart Chrome today, and check the About Google Chrome page regularly, as Google recommends, rather than waiting for background updates to land.