Google Chrome users in India and the US must update immediately: CERT-In has flagged a critical, actively exploited vulnerability in Chrome versions earlier than 157.0.8103.50 — and it’s already being used in the wild. The flaw, tracked as CVE-2026-125350, is a use-after-free bug in Chrome’s XML handling. Attackers can trigger it by luring victims to a malicious webpage.
No user interaction beyond visiting the site is needed. Once exploited, it could let attackers run arbitrary code, bypass security restrictions, or fully compromise the device. CERT-In rated it ‘critical’ in Vulnerability Note CIVN-2026-0544, the highest severity tier. Google patched it on November 9.
But if you’re still on Chrome 156 or earlier, you’re exposed. Right now. Not tomorrow. Not after lunch.
Now. Chrome Extended Stable users are also affected: versions earlier than 156.0.8078.96 need updating too. This isn’t theoretical. CERT-In confirmed active exploitation, meaning real attacks are happening against unpatched systems across India.
The agency issued its advisory on November 12, urging users to “apply the latest patches immediately.” It also advised avoiding suspicious links and unfamiliar websites until the browser is updated. Updating is simple, but manual. On desktop: click the three-dot menu → Help → About Google Chrome. Chrome checks, downloads, and prompts a relaunch.
On Android or iOS, go to the Play Store or App Store and update Google Chrome. There is no automatic background rollout for this patch. You have to act. The vulnerability is one of six critical flaws patched in this round.
Others include type confusion in V8 (Chrome’s JavaScript engine), an out-of-bounds write in GPU code, incorrect authorisation in FileSystem, a buffer overflow in Compositing, and uninitialised resource bugs in WebGL and GPU components. All could lead to remote code execution or system compromise. This warning lands amid a broader cybersecurity crisis in India.
CERT-In recently flagged vulnerabilities across Android versions, PHP, NodeJS, and weak eMudhra digital signature keys, a cascade dubbed ‘Black October’ by some analysts. The agency has also warned that hackers are now weaponising AI tools to automate attacks, with rogue AI agents already breaching sensitive organisational data in India. Google has not disclosed who’s behind the attacks or how they’re being deployed.
The flaw was reported anonymously on November 6, four days before the patch dropped. There is no Indian price or launch detail here. This is not a product release. It’s an emergency.
Chrome is not for sale. It’s for securing, and right now, it’s failing that job unless you update. Google Chrome download links are available at google.com/chrome. The current stable version is 157.0.8103.50, verified by Google’s own release notes and CERT-In’s advisory.
If your browser says otherwise, open it. Update it. Relaunch it. Then breathe.
GDFiled by The Gadgets Desk
Audio, wearables, cameras, tablets, chargers and every other device worth carrying or plugging in.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.