CERT-In has issued a Critical security advisory for multiple vulnerabilities in the desktop version of Google Chrome, warning users across consumer, enterprise and government networks to install the latest update. Google has confirmed that at least one of the flaws is being actively exploited in the wild.
The advisory, identified as CIVN-2026-0544, was issued on 10 November 2026. It covers nine vulnerabilities affecting different parts of Chrome, including the V8 JavaScript engine, graphics processing, file-system handling and compositing components. The vulnerabilities could allow unauthorised code execution or cause a denial-of-service condition.
The actively exploited flaw
The most urgent issue is tracked as CVE-2026-125350. It is described as a high-severity use-after-free vulnerability in Chrome’s XML processing component. Google has confirmed active exploitation, meaning attackers are already using the flaw against targets rather than it being only a theoretical security risk.
According to the advisory, the vulnerability can be triggered remotely when a user visits a specially crafted webpage. CERT-In has not advised users to stop using Chrome, but its Critical classification underlines the need to apply the security release without delay. Users should avoid opening links or webpages that they do not trust until their browser has been updated.
“Critical” — CERT-In’s severity classification for advisory CIVN-2026-0544
Who is affected and what to do
Desktop installations of Chrome older than version 157.0.8103.50 on Windows, macOS and Linux are listed as vulnerable. Google’s security release addresses all nine vulnerabilities covered by the advisory. After installing the update, Chrome must be relaunched for the fix to take effect.
| Detail | Information |
|---|---|
| Advisory | CERT-In CIVN-2026-0544 |
| Severity | Critical |
| Actively exploited flaw | CVE-2026-125350 |
| Affected platforms | Windows, macOS and Linux |
| Safe Chrome version cited | 157.0.8103.50 or later |
| Vulnerabilities addressed | Nine |
For people using Chrome on managed computers, the update may be controlled by an organisation’s IT team. Businesses and government departments should therefore verify that the patched version has been deployed across systems rather than relying only on individual users to install it. Consumer users should also check whether their desktop browser has reached the version specified by CERT-In and relaunch it after the update.
- Update Google Chrome to 157.0.8103.50 or later.
- Relaunch the browser after the update is installed.
- Apply the update on Windows, macOS and Linux desktop systems.
- Organisations should confirm deployment across managed devices.
The advisory is particularly significant because the risk is not limited to a newly disclosed bug. Google has confirmed exploitation of CVE-2026-125350, while CERT-In has classified the wider set of issues as Critical. Keeping Chrome patched reduces exposure to webpages designed to abuse the affected components, but users should continue to treat unexpected links and websites with caution.
