Chrome zero-day CVE-2026-125350: the update only counts after a restart
On Monday, November 9, 2026, Google released an emergency Chrome update. Of the nine flaws fixed, one is already being used by attackers: the Chrome zero-day CVE-2026-125350. It’s the eighth time since January that Google has had to fix a Chrome flaw exploited before a patch even existed.
For a small business, the browser is the most used tool of the day: Microsoft 365, online banking, accounting software, the CRM, everything goes through it. An exploited Chrome flaw can let a booby-trapped web page run code on the computer. The good news: the fix takes two minutes per computer. The bad news: it only takes effect when the browser restarts, and many people never close Chrome.
Chrome zero-day CVE-2026-125350: what we know
8th
Chrome zero-day exploited since the start of 2026
Nov. 6
the day an anonymous researcher reported the flaw to Google
3 days
between the report and the patch released on November 9
9
flaws fixed in this update, 7 of them rated high severity
The flaw is in the component that reads XML, a very common data format on the web. It’s a “use-after-free” bug: Chrome frees a piece of memory, then mistakenly uses it again. An attacker who controls a web page can use it to corrupt memory and, in the worst case, run their own code. Google confirms an exploit “exists in the wild” but is keeping details private until most users have updated. So we don’t yet know who is being targeted.
The versions you need
Check a computer in two minutes
In Edge, the path is similar: ⋯ > Help and feedback > About Microsoft Edge. On a phone, go through the Play Store or the App Store.
4 myths about browser updates
❌ Myth 1
“Chrome updates itself, I don’t need to do anything.”
✅ Fact 1
It downloads the update by itself, but only applies it on restart. A computer that’s never shut down can keep a vulnerable version for weeks.
❌ Myth 2
“I use Edge, this doesn’t affect me.”
✅ Fact 2
Edge is built on the same engine as Chrome. It gets its own fix: check its version too.
❌ Myth 3
“I only visit well-known sites.”
✅ Fact 3
Legitimate sites are regularly hacked or show booby-trapped ads. One page is enough.
❌ Myth 4
“Our antivirus will block the attack.”
✅ Fact 4
It helps, but a browser flaw is exploited inside a trusted program. The patch is still the real protection.
The simple rule to put in place
Browsers: 4 rules for your business
⏰ Mandatory relaunch within 48 h
With Microsoft Intune or Group Policy, force a browser restart within 48 hours of a security update.
📋 One approved browser
Ideally Edge or Chrome, not both, with as few extensions as possible. Less software to keep an eye on.
🔎 A version inventory
Your IT provider should be able to tell you in 5 minutes how many computers are still vulnerable.
💤 Close the browser on Friday
A simple habit: fully close Chrome and Edge at the end of the week, or restart the computer.
Extensions deserve a look too: in October, 319 malicious Chrome extensions were hijacking their users’ searches. And if a computer was hit, remember that attackers often try to steal open sessions: read why, in that case, changing the Microsoft 365 password isn’t enough.
How NeoTech can help
We manage updates on your computers, browsers included, with policies that force a restart at the right time and a clear report of computers that are behind. Our automated 24/7 monitoring with on-call technician intervention responds if a computer behaves abnormally after visiting a site. Learn about our managed IT services and our cybersecurity services.
Book your free cyber check
In 30 minutes, we review with you how your browsers and computers get updated, and how many are behind today.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Google — Chrome Releases, Stable Channel Update for Desktop (Nov. 9, 2026)
- SecurityWeek — Chrome update patches exploited XML zero-day, eighth this year
- The Hacker News — Google issues Chrome security update for eighth actively exploited zero-day of 2026
Photo: AS Photography, Pexels (Pexels licence).