Google patched Chrome’s eighth actively exploited zero-day of 2026 on November 9. CVE-2026-125350 is a use-after-free in Chrome’s XSLT engine — a buried component most developers never think about — and an exploit is confirmed in the wild. Chrome 157 is the fix. If you’re on anything older, you’re exposed. So are your users running Electron apps that haven’t yet updated their pinned Chromium dependency.
What the Bug Actually Is
The flaw lives in libxslt’s pattern-matching cache: specifically in xsltTestCompMatchDirect(), the function Chrome calls when evaluating XPath patterns inside XSLT stylesheets. The cache exists so repeated pattern tests reuse a computed node-set instead of re-evaluating the XPath every time.
The problem is re-entrancy. The function reads a cached pointer, then calls xmlXPathEval(). If the stylesheet contains a lazily-evaluated global variable — something like xsl:number — that nested evaluation can re-enter the same cache slot, free the cached object, and replace it. When the outer call then tries to free its original pointer, it’s freeing already-freed memory. Double-free, stale pointer, memory corruption.
The fix is a single-line logic change: re-read the cache slot after evaluation completes instead of before. A subtle bug that an anonymous researcher caught on November 6 — three days before the patch landed.
Triggering it requires a malicious page that loads an attacker-controlled XML document with an xml-stylesheet processing instruction, or a crafted XSLT stylesheet. No user interaction beyond opening the page.
Update Chrome Now — The Exact Versions
Go to chrome://settings/help and update. Then relaunch — a background update that isn’t relaunched doesn’t activate the fix.
- Chrome Stable (Windows/macOS): 157.0.8103.50 or .51
- Chrome Stable (Linux): 157.0.8103.50
- Chrome Extended Stable (Windows/macOS): 156.0.8078.96
Enterprise teams: Chrome’s default RelaunchNotificationPeriod policy allows users to defer relaunches for seven days. For an actively exploited zero-day, shorten that window via Group Policy or Google Workspace admin.
Electron Developers: The Browser Patch Isn’t Enough
Chrome 157 corresponds to Chromium M157. Current Electron versions ship earlier Chromium milestones: Electron 45 bundles Chromium M156, Electron 44 bundles M152, Electron 43 bundles M150. All of them are still on a vulnerable Chromium version.
That matters because VS Code, Slack, Figma, Obsidian, 1Password, and thousands of other Electron-based apps all embed their own Chromium. Updating Chrome in the browser doesn’t update the Chromium inside those apps.
Check your renderer’s user-agent string to see what version you’re shipping:
// In your Electron renderer process console
navigator.userAgent
// You want to see Chrome/157 or higher
// If you see Chrome/156 or below — you need an Electron updateWatch your Electron release notes. The Electron team will ship a patch once they pin to Chromium 157+. Pin to that version as soon as it lands.
Other Chromium-Based Browsers
Microsoft Edge and Brave typically trail Chrome by a few days on security patches and should be close behind. Opera is a different story — Opera One 139 was based on Chromium 155 at the time Chrome 157 shipped, putting it about four weeks behind. If your users run Opera, they’re not covered yet.
Vivaldi and Samsung Browser have their own update cadences. Check their respective release notes before assuming coverage.
Eight Zero-Days in 2026 — What the Pattern Tells You
This is Chrome’s eighth actively exploited zero-day this year. That averages out to roughly one every six weeks. Five of the eight hit V8 or GPU subsystems; this one broke the XSLT parser. The common thread isn’t a single weak subsystem — Chrome’s attack surface is broad, and state-sponsored actors and criminal groups are actively hunting it.
Google accelerated its release cycle to two weeks in September 2026, which compresses the window between patch availability and delivery. But it doesn’t solve the Electron lag or third-party browser delays. Those gaps remain the real exposure window for most developer-built apps.
Three Things to Do Right Now
- Update Chrome and relaunch — confirm you’re on 157.0.8103.50 or later via
chrome://version - Check your Electron app — inspect
navigator.userAgentin the renderer; subscribe to Electron release notifications - Alert users on other Chromium browsers — especially Opera users, who may be weeks away from a fix
Full technical breakdown of the XSLT re-entrancy flaw is available in Ostorlab’s advisory. SecurityWeek’s coverage has the full CVE list for Chrome 157.
