CERT-In Warns of Serious Chrome Vulnerabilities, Advises Immediate Updates
CERT-In has issued a warning about critical vulnerabilities in Chrome, urging users in India to update their browsers to protect against potential attacks.
NEW DELHI, Nov 12: The Indian Computer Emergency Response Team (CERT-In) has urged Google Chrome users in India to update their browsers immediately due to several critical security vulnerabilities. The agency noted that one of these weaknesses is already being exploited in the wild.
On November 10, 2026, CERT-In released advisory note CIVN-2026-0544, identifying vulnerabilities in Chrome versions prior to 157.0.8103.50, including extended stable versions older than 156.0.8078.96. The reported flaws involve a use-after-free bug in XML handling, type confusion in the V8 JavaScript engine, and out-of-bounds memory writes in the GPU component.
According to CERT-In, persuading a user to open a malicious webpage can allow an attacker to execute arbitrary code on their system, bypass browser security measures, or cause a denial-of-service condition. The agency characterized the risk of system compromise as high.
Among these vulnerabilities, CVE-2026-125350 is particularly concerning as it is actively exploited, prompting CERT-In to recommend users install the latest patches without delay. The updates can be quickly applied through Chrome’s menu by navigating to Help and selecting ‘About Google Chrome’.
Google has confirmed the existence of this high-severity vulnerability, noting that it involves a use-after-free issue in the XML component, which could allow code execution within the browser sandbox when users visit crafted HTML pages. An anonymous researcher reported the flaw on November 6, 2026.
Google has been addressing multiple zero-day vulnerabilities throughout the year, fixing eight significant vulnerabilities in Chrome since the beginning of 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also included this Chrome vulnerability in its Known Exploited Vulnerabilities catalog, compelling federal agencies to apply the necessary patches by November 24, 2026.
Users are advised to update their Chrome browsers to versions 157.0.8103.50 for Windows and macOS, and 157.0.8103.50 for Linux. Those using other Chromium-based browsers like Microsoft Edge and Brave should implement fixes as soon as they become available. Until updates are applied, users should avoid clicking on suspicious links and visiting unknown websites.