A Chrome zero-day is being exploited in the wild, and Google has already shipped the fix. Update Chrome to version 157.0.8103.50 or newer, then relaunch the browser so the patch actually takes effect.
The flaw sits in Chrome’s XML handling, and according to Techlicious, attackers were already using it before the patch landed. Here’s what we know, what we don’t, and how to check your own browser in under a minute.
These are the details worth knowing at a glance:
- Fixed in Chrome 157.0.8103.50 (Windows, Mac, Linux, Android), with .51 also listed for Windows and Mac
- The bug is a use-after-free flaw in Chrome’s XML component
- It was reported to Google on November 6 by an anonymous researcher, and the patch followed three days later
- Techlicious, citing SecurityWeek, counts it as the eighth Chrome zero-day exploited this year
- The rollout reaches everyone over days or weeks, so don’t wait for it to show up on its own
What the Chrome zero-day actually is
A zero-day is a flaw that attackers find and use before the vendor has a fix. This one is a use-after-free bug, which means Chrome keeps using a piece of memory after it has been released.
Memory bugs like this can crash the browser. In some cases they let an attacker run their own code, which is why they’re a favorite target. Google has not published much beyond the basics, and bug details often stay restricted until most people have updated.
That secrecy is normal, but it also means we don’t know who was targeted or how the attacks worked. Anything claiming to know more right now is guessing.
Eight exploited Chrome zero-days in one year, if the SecurityWeek count holds, is a lot of emergency patching. Your browser is the front door to your email, banking and work accounts, so attackers keep hunting for ways through it. That’s why fixes like this one arrive between Google’s regular release dates.
This isn’t the same as the big Chrome 157 release
If you read our earlier look at the Chrome 157 update with 213 security fixes, you might assume you’re covered. You may not be.
Chrome 157 reached the stable channel on November 3 as build 157.0.8103.38, according to Google’s Chrome Releases blog. The zero-day fix arrived in a follow-up build, .50, a few days later.
So “I’m on Chrome 157” isn’t enough. The last few digits of the version number are what matter here.
How to check your Chrome version and update
The table below shows which build you need on each platform and where to get it.
| Platform | Fixed build | How to get it |
|---|---|---|
| Windows | 157.0.8103.50 or .51 | Menu, then Help, then About Google Chrome |
| Mac | 157.0.8103.50 or .51 | Menu, then Help, then About Google Chrome |
| Linux | 157.0.8103.50 | Your package manager or Chrome’s About page |
| Android | 157.0.8103.50 | Google Play, rolling out over the next few days |
On desktop, open the three-dot menu, choose Help, then About Google Chrome. Chrome checks for the update, downloads it, and asks you to relaunch.
If Chrome says it’s up to date but shows an older build, don’t panic. Google says the rollout may take days or weeks, so the update reaches machines gradually. Check again in a few hours, and make sure you’re on the stable channel rather than a beta.
Don’t skip the relaunch. Until you restart, the old, vulnerable code can keep running, and a pile of open tabs is exactly what makes people put it off.
Edge, Brave, Opera and other Chromium browsers
Chrome isn’t the only browser built on this code. Other Chromium-based browsers need their own updates, and they don’t all ship on the same day.
Techlicious reports that Vivaldi has released patches, but it had not confirmed fixes for Microsoft Edge, Brave or Opera when it wrote the story. Open each browser’s own About page and run its update check rather than assuming it’s safe.
It’s also worth running your system updates. Microsoft’s November release was heavy on fixes too, and we covered the Patch Tuesday Outlook zero-day separately.
What to do if you can’t update right away
Sometimes a work laptop or a managed device blocks the update. If that’s you, a few habits lower the risk until the patch arrives.
- Avoid opening links from emails, chats and ads you didn’t expect
- Stay off unfamiliar sites, especially ones that ask you to click through prompts
- Ask your IT team when the update is scheduled, and mention it’s an exploited flaw
None of these replaces the patch. They just shrink the window of exposure.
Frequently Asked Questions
Is the Chrome zero-day patched?
Yes. Google fixed it in Chrome 157.0.8103.50 for Windows, Mac, Linux and Android. Android is rolling out through Google Play over a few days.
How do I know if I’m affected?
Open Chrome, go to Help, then About Google Chrome, and read the version number. If it’s lower than 157.0.8103.50, you’re still exposed and should update now.
Do I need to restart Chrome after updating?
Yes. Chrome downloads the fix in the background, but it only applies after you relaunch the browser.
Is there a CVE number for this flaw?
We couldn’t confirm one from Google’s own release notes at the time of writing, so we’re not quoting one. Check Google’s Chrome Releases blog for updates.
Our take
Update today, not this weekend. Exploited browser flaws are the ones that turn into real-world compromise, and the fix takes about a minute. If your version ends in .50 or higher, you’re done; if it doesn’t, relaunch and check again, then do the same on your other Chromium browsers.
Leave a Reply