Security alert for Tampa Bay businesses. On November 9, 2026, Google released a new Chrome update that fixes a high-severity flaw, CVE-2026-125350, which Google says is being actively exploited in the wild. If you use Chrome — or if your managed IT provider manages the Chrome on your computers — update and restart now.
What CVE-2026-125350 Is
CVE-2026-125350 is a high-severity use-after-free vulnerability in the XML component of Chrome, according to Google. Google’s release notes state that an exploit exists in the wild, and the flaw was reported anonymously on November 6, 2026. In plain terms, a use-after-free happens when a program uses a piece of memory after it has already been freed; a malicious web page could trigger that condition while you browse. We are not describing any specific attack, and this notice does not mean that any Virtual IT Group client or your business has been affected.
Which Versions Are Affected
This fix is included in the Chrome builds below. Update to one of these (or a later build) for your channel:
- Stable channel — Windows and Mac: 157.0.8103.50 or 157.0.8103.51
- Stable channel — Linux: 157.0.8103.50
- Extended Stable channel — Windows and Mac: 156.0.8078.96
This release also fixes nine additional security issues, per Google’s release notes. Confirm the exact build against Google’s release notes, because the fixed build differs by channel — do not assume that every 156-series build is unpatched if your computers run the Extended Stable channel.
What To Do Now
1. Open Chrome, then go to Help > About Google Chrome. Chrome checks for updates and offers one if a newer version is available.
2. Install the offered update, then choose Relaunch (restart) when prompted so the fix actually takes effect.
3. Recheck the version in Help > About Google Chrome to confirm it matches a fixed build for your channel (157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux, or 156.0.8078.96 on Extended Stable).
4. If your computers are managed by an IT provider or by your organization, coordinate with them to confirm the update is deployed and each device has been restarted. A patch that is installed but not restarted may not be active yet.
Questions About This Alert
Is my business already affected? This is a general security notice. It does not mean that any Virtual IT Group client, or your business, has been compromised.
How do I know the update worked? After you install and relaunch, recheck Help > About Google Chrome. If the version matches a fixed build for your channel, the update is in place.
What if I do not run Chrome? If none of your computers or your managed provider run Chrome, this specific flaw does not apply to you. The risk is to any device that does.
Sources: Google Chrome Releases — Stable Channel Update for Desktop · Google Chrome Releases — Extended Stable Update for Desktop · Google support — Update Chrome.
Virtual IT Group runs a cybersecurity readiness check for Tampa Bay businesses — confirming which systems you run, whether they are patched, and what to close first. Request a cybersecurity check for your business.
AI-assisted