Image: Wikimedia Commons — Google Chrome running on Windows 11 (public domain). CERT-In's warning covers the desktop browser shown here, on Windows, macOS and Linux.
TL;DR: The CERT-In Chrome warning November 2026 is a critical alert from India's cybersecurity agency: Chrome versions before 157.0.8103.50 carry several flaws, and one of them — zero-day CVE-2026-125350 — is already being exploited in real attacks. Google shipped the patch on 9 November. Updating Chrome and relaunching it closes the hole, so check your version now.
Key Highlights
- CERT-In published Vulnerability Note CIVN-2026-0544 on 10 November 2026 and rated it "critical": multiple vulnerabilities in Google Chrome for desktop could let a remote attacker run arbitrary code, bypass security restrictions or crash the browser.
- One flaw, CVE-2026-125350 — a high-severity use-after-free bug in Chrome's XML handling — is already being exploited. Google confirmed "an exploit for CVE-2026-125350 exists in the wild". It was reported anonymously on 6 November and patched on 9 November, three days later.
- The 9 November update fixes nine security issues in total, including a second XML use-after-free, type confusion in the V8 JavaScript engine, out-of-bounds writes in the GPU, incorrect authorisation in FileSystem, a buffer overflow in Compositing and uninitialised-use bugs in WebGL and the GPU.
- An attacker only needs to get a victim to open a specially crafted webpage. No download, no installation and no extra click beyond visiting the page is required for the flaws to be reachable.
- The fix is to update to Chrome 157.0.8103.50 or .51 on Windows and macOS, 157.0.8103.50 on Linux and Android, or Extended Stable 156.0.8078.96 — and then relaunch the browser, because the patch only takes effect after a restart.
What happened?
On Monday 9 November 2026, Google published a Stable channel update for Chrome on desktop that fixed nine security issues. One of them stood out: CVE-2026-125350, a high-severity flaw in the part of Chrome that processes XML data, for which Google said an exploit already exists in the wild. That makes it a zero-day — a vulnerability attackers were using before a patch existed — and the eighth actively exploited Chrome zero-day Google has patched in 2026, according to security researchers tracking the count. It is as many as Google patched across the whole of 2025, with two months of the year still to go.
The next day, 10 November, India's Computer Emergency Response Team (CERT-In), the national agency under the Ministry of Electronics and Information Technology, issued its own warning. Vulnerability Note CIVN-2026-0544 rates the flaws critical and tells Chrome users in India to apply Google's updates without delay. The advisory singles out CVE-2026-125350 as actively exploited, which is why the warning is urgent rather than routine: CERT-In issues Chrome advisories several times a year, but most of them describe flaws that have not yet been seen in attacks. This one describes a flaw that has.
Chrome 157 itself had only just arrived — our explainer on Chrome 157's new features covered the release a few days earlier. The 9 November update is a separate security release on top of it: it does not add features, it closes holes, and it matters most to anyone who has not yet updated past 157.0.8103.50.
CERT-In Chrome warning November 2026: the zero-day at its centre
CVE-2026-125350 is a use-after-free vulnerability in Chrome's XML component. In plain terms, it is a memory-management error: the browser frees a piece of memory and then tries to use it again, and an attacker who can control what lands in that memory can turn the mistake into code running on the victim's machine. Security researchers tracing the public Chromium patch say the root cause sits in libxslt, the library Chrome uses for XSLT transformations of XML documents — specifically in a caching feature used when matching XSLT patterns.
Three facts make this one different from the other eight flaws fixed in the same release. First, it was reported anonymously to Google on 6 November 2026, and the fix shipped three days later — an unusually fast turnaround that usually signals Google believed the flaw was being used. Second, Google confirmed exploitation in its own release notes rather than leaving it to outside researchers. Third, Google has restricted access to the underlying bug report until most users have updated, so the technical details of how the attacks work are not public yet.
What Google has not said is who is behind the attacks, who is being targeted, or how the exploit is delivered — whether it arrives through a malicious ad, a compromised website, a phishing link or some other route. That is normal for a fresh zero-day: disclosing the mechanism before users patch would hand the same trick to every other attacker. It also means nobody can honestly say how widespread the attacks are, only that they exist. The flaw was also added to the US CISA Known Exploited Vulnerabilities catalogue on 10 November, with a remediation deadline of 24 November 2026 for federal agencies.
.svg?width=900)
Image: Wikimedia Commons — the Google Chrome icon (public domain). The zero-day sits in Chrome's XML handling, not in an extension or a website — updating the browser itself is the fix.
Which Chrome versions are affected?
CERT-In's advisory covers Chrome versions older than 157.0.8103.50, and Extended Stable versions older than 156.0.8078.96. The fixed versions differ slightly by platform and channel, so check yours against this table:
| Platform and channel | Affected versions | Fixed version |
|---|---|---|
| Windows, Stable | Before 157.0.8103.50 | 157.0.8103.50 or .51 |
| macOS, Stable | Before 157.0.8103.50 | 157.0.8103.50 or .51 |
| Linux, Stable | Before 157.0.8103.50 | 157.0.8103.50 |
| Android, Stable | Before 157.0.8103.50 | 157.0.8103.50 |
| Windows and macOS, Extended Stable | Before 156.0.8078.96 | 156.0.8078.96 |
Extended Stable is the slower-moving channel many organisations use, so it is easy to miss: its users need 156.0.8078.96, not 157. The same 9 November release also delivered the fix to Android. Google's desktop and Android release notes do not address Chrome on iOS in the same posts, so iOS users should check the App Store for the latest Chrome update rather than assuming they are covered.
To see which version you are running, open Chrome and look at Help > About Google Chrome — the page shows the version number and checks for updates at the same time. If your number is lower than the fixed version for your platform, you are on an affected build.
How to update Chrome now
The update itself takes about a minute, but the step people skip is the relaunch: Chrome downloads updates in the background and only applies them when the browser restarts, so a patch that has been downloaded but never applied protects nothing.
On Windows, macOS or Linux: open Chrome, click the three-dot menu in the top-right corner, go to Help, then About Google Chrome. Chrome checks for an update automatically and downloads it if one is available. When it finishes, click Relaunch. After the restart, return to the same page and confirm the version number matches the fixed version in the table above.
On Android: open the Google Play Store, search for Chrome, and tap Update if the button is shown. If no update is offered yet, check again later — Google says the rollout reaches users over days and weeks, so the fixed version may not be available to everyone at the same moment.
On iOS: open the App Store, tap your profile picture, scroll to available updates and update Chrome if it is listed.
Until you are on a fixed version, CERT-In's advice is to avoid suspicious links and unfamiliar websites. That is general hygiene rather than a specific defence — the exploited flaw can be triggered by a crafted webpage, and there is no setting that blocks it — so the real protection is the update, not caution alone. If you manage Chrome for a family member, a small office or a classroom, check their browsers too: the people least likely to update are the ones most likely to be running an old version.
Why it matters for readers in India
Chrome is the default browser for most Indian internet users, on phones and on desktops, which is why a CERT-In warning about it lands differently from an advisory about enterprise software most readers never touch. A flaw that only needs a crafted webpage to reach is a flaw that can reach anyone who browses — and CERT-In's critical rating is its strongest, reserved for vulnerabilities with a high chance of serious impact.
The advisory does not name any Indian organisation or individual as a victim, and no Indian compromise has been reported in connection with CVE-2026-125350. The risk it describes is exposure, not confirmed harm: anyone on an affected version could be attacked, and the update removes that exposure. That distinction matters, because it is the difference between "update now" and "you have already been hacked" — and only the first is true.
The warning also fits a pattern Indian readers will recognise. CERT-In has issued Chrome advisories through the year — an October advisory (CIVN-2026-0505) covered flaws fixed in Chrome 155, and a September one covered Chrome 153 — but this is the first in the recent run to carry a confirmed actively exploited zero-day. It also arrives in a heavy patch week: Microsoft's November Patch Tuesday fixed 1,094 flaws, including an exploited Outlook bug. And CERT-In's recent Crafty Falcon advisory warned that AI-assisted attackers are targeting Indian banks and fintech firms — a different threat, but the same lesson: the agency is seeing faster, more automated attacks against Indian users and institutions, and unpatched software is the easiest way in.
Should you care?
Verdict: ✅ Yes — update Chrome today, then relaunch it. This is not a theoretical warning: one of the flaws is already being exploited, the fix has been available since 9 November, and applying it takes about a minute. If your version is already 157.0.8103.50 or newer (or 156.0.8078.96 on Extended Stable), you are done. If it is older, update now and check the version number again after relaunching — and help anyone in your household or office who would not think to check.
What is still unknown
Honest gaps matter as much as the confirmed facts. Google has not said who is exploiting CVE-2026-125350, who they are targeting, or how the exploit reaches victims, and the bug report stays restricted until most users have updated — so the scale and the targets of the attacks are unknown. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 10 November 2026, with a 24 November remediation deadline for US federal agencies. Google has also published no CVSS score for the flaw in its advisory, only its own "High" severity rating. And while the 9 November release fixes nine security issues, only CVE-2026-125350 is confirmed as exploited — the other eight, including the second XML use-after-free (CVE-2026-125346), are not known to be under attack, which is why this post does not treat them as zero-days.
FAQs
Is my Chrome browser affected by the CERT-In warning?
It is affected if your Chrome version is older than 157.0.8103.50 on Windows, macOS, Linux or Android — or older than 156.0.8078.96 if you are on the Extended Stable channel. Open Help > About Google Chrome to see your version; the same page downloads the update if one is available. Being on an affected version does not mean you have been attacked — it means you could be, until you update.
What is CVE-2026-125350?
CVE-2026-125350 is a high-severity use-after-free vulnerability in Chrome's XML handling, in the libxslt library Chrome uses for XSLT transformations. It was reported anonymously to Google on 6 November 2026, and Google confirmed on 9 November that an exploit for it exists in the wild — making it the eighth actively exploited Chrome zero-day patched in 2026. The fix is in Chrome 157.0.8103.50/.51 (Windows and macOS), 157.0.8103.50 (Linux and Android) and Extended Stable 156.0.8078.96.
How do I update Google Chrome to the latest version?
On a computer, click the three-dot menu in the top-right corner of Chrome, go to Help, then About Google Chrome. Chrome checks for updates automatically; when one is available it downloads it, and you then click Relaunch to apply it. On Android, update Chrome from the Google Play Store; on iOS, from the App Store. Always confirm the version number after relaunching — the update only takes effect once the browser restarts.
Has anyone been hacked through this Chrome flaw?
Google has confirmed that an exploit for CVE-2026-125350 exists in the wild, which means attacks have happened — but it has not named any victim, target or organisation, and CERT-In's advisory names no Indian victim either. No loss figure or victim count has been published. The confirmed fact is the exploitation, not its scale, so the honest answer is that attacks are real and the targets are undisclosed.
Takeaway
CERT-In's critical warning is simple to act on and hard to argue with: a Chrome zero-day is being exploited, the patch has been out since 9 November, and the only thing standing between an affected browser and the fix is a one-minute update and a relaunch. Check your version, update if it is below 157.0.8103.50 (or 156.0.8078.96 on Extended Stable), and confirm the number after restarting — then check the browsers of the people around you who would not think to.
If you want the context on the browser itself, start with what Chrome 157 actually changed — the features that arrived just before this security update.
Sources
- YourStory, "CERT-In flags critical security flaws, urges Chrome users in India to update browsers" (11 Nov 2026) — reporting CERT-In Vulnerability Note CIVN-2026-0544, issued 10 Nov 2026
- NewsBytes, "CERT-In warns Indian Google Chrome users of active exploit" (11 Nov 2026)
- News24, "Google Chrome users alert: Indian government flags critical security flaws, update browser immediately" (11 Nov 2026)
- ABC Live, "Chrome Security Patch Verification: Beyond the Warning" (11 Nov 2026) — verification of the advisory's version thresholds and evidence status
- ThreatAft, "Chrome 8th Zero-Day: XML UAF Exploited in Wild" — CVE-2026-125350 detail, fixed versions and 2026 zero-day count
- SOC Prime, "CVE-2026-125350: Chrome XML Zero-Day Exploited" — report date, libxslt root cause and CISA KEV status as of 10 Nov 2026
Comments
Post a Comment