pwned.coffeeOrder ticket · today's special · 10 Nov 2026

🔥 On the fly · exploited in the wildUS federal deadline 2026-11-24Scalding · 540°ChighOrder up · fix available

Google Chrome: zero-day exploit

Chrome

Google issues Chrome security update for eighth actively exploited zero-day of 2026.

Binds US federal agencies under CISA BOD 26-04.

Do this now

Update Chrome to version 157.0.8103.50 now, since this zero-day is being actively exploited.

Who should check: teams running Chrome

Fix it

Upgrade to Chrome 157.0.8103.50

First seen: 10 Nov 2026
Last update: 11 Nov 2026, 08:17 UTC
Fixed in: 157.0.8103.50
Identifiers: CVE-2026-125350
CVSS: 8.8
KEV deadline: 2026-11-24
Source: news
On the menu as: Chrome

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Google Chrome: zero-day exploit
Severity: high, exploited in the wild. Patch status: patched.
Affected: Chrome
Fixed in: 157.0.8103.50
Ids: CVE-2026-125350

Google issues Chrome security update for eighth actively exploited zero-day of 2026.

## Steps
1. Search the repo, its CI and infra config for Chrome. If present, report the version in use and whether it's affected.
2. Fix by release line: Chrome: 157.0.x → 157.0.8103.50.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Chrome 157.0.x | fixed | 157.0.8103.50 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-125350") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/11/google-issues-chrome-security-update.html https://securityaffairs.com/202772/breaking-news/google-fixes-the-eighth-actively-exploited-chrome-zero-day-of-2026.html https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html https://nvd.nist.gov/vuln/detail/CVE-2026-125350
https://pwned.coffee/i/google-chrome-zero-day-exploit-cve-2026-125350

Timeline

11 Nov 2026, 08:17 UTC
Fix status: unknown → patched.
10 Nov 2026, 19:17 UTC
Added to CISA Known Exploited Vulnerabilities (federal deadline 2026-11-24).
10 Nov 2026, 10:17 UTC
Reported by securityaffairs.com: Google fixes the eighth actively exploited Chrome zero-day of 2026
10 Nov 2026, 07:18 UTC
Fix status: patched → unknown.
10 Nov 2026
First reported.

Receipt

Exploitation: Exploited: listed in CISA KEV
CISA KEV “CVE-2026-125350 added to CISA KEV on 2026-11-10, federal deadline 2026-11-24.” source
Overheard “Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026.” source
Fix by release line: Product Affected Fixed in Source
Chrome 157.0.8103.50 to before 157.0.8103.50 157.0.8103.50 CVE record (CNA) checked 13 Nov
Score: CVSS 8.8 (high). CVSS 3.1 8.8 (CISA ADP) for CVE-2026-125350
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
Chrome	157.0.8103.50 to before 157.0.8103.50	157.0.8103.50	CVE record (CNA) checked 13 Nov

Sources: KEV ✓ CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone hot coffee