Google has patched a Chrome vulnerability that the NVD listing rates 9.6 out of 10, and that could let a remote attacker take control of a workstation from a simple webpage. The fix comes down to one sentence: make sure every workstation in your company is running Chrome 157.0.8103.50 or newer.
What is it?
A flaw in the Chrome browser that lets a booby-trapped webpage break out of the sealed-off area where the browser is supposed to keep it, and act on the computer itself.
Normally, a browser isolates each webpage in a contained space called a sandbox. Think of it like a garden shed at the back of the yard: whatever happens in there doesn’t get into the house. CVE-2026-125347 is an improperly verified permission: the door between the shed and the house can be forced open. According to the NVD listing, the attack requires the person to be led into opening a specially crafted page themselves, for example through a convincing email.
Why is it serious?
Because one unlucky click from an employee can be enough to hand over control of their workstation, along with the documents and access tied to it.
The NVD listing is the entry published in NIST’s reference database, which catalogues known vulnerabilities. It carries a CVSS 3.1 score of 9.6 out of 10 set by the reporting organization (CNA), on a severity scale that runs from 0 to 10. The same listing also carries the Chromium project’s “High” classification. No exploitation has been reported in that listing as of now. We don’t take that to mean the risk is lower: the vulnerability is publicly documented and a fix already exists. A hijacked workstation can halt a team’s work, expose client information, or be used to set up wire transfer fraud from an email inbox.
Who is affected?
Every version of Google Chrome prior to 157.0.8103.50, on every workstation where that browser is installed.
The product affected is Chrome, published by Google. The versions affected are those prior to 157.0.8103.50; that version and later ones contain the fix. The NVD listing doesn’t specify which operating systems are affected: when in doubt, treat every workstation running Chrome as exposed. A garage, a clinic, or an accounting firm are in the same position here as a large corporation.
How do I check my business?
Check the Chrome version number on every workstation, then make sure updates install automatically without manual action.
- Have the installed version checked on every workstation, via the Help menu then “About Google Chrome.” Confirm it reads 157.0.8103.50 or newer (IT provider or whoever manages your computers).
- Turn on automatic browser updates (IT provider).
- Track down forgotten machines: the laptop of an employee on leave, the reception desk computer, a former employee’s machine still connected to the network. Patch them or take them off the network (management and IT provider).
Scenario
Fictional example: a dental clinic in a small town hadn’t applied the fix on the reception desk computer.
One morning, the receptionist gets an email that looks like an invoice reminder and clicks the link. By late morning, the appointment software stops responding and patient files won’t open. The clinic spends the day on the phone, the IT provider rebuilds the machine, and management is left wondering whether patient information went out the door. The fix, meanwhile, had been available for days.
What a Chrome vulnerability like this means for a local business
For a Canadian SMB, the real issue isn’t the browser: it’s the gap between a patch being released and it actually being installed. The Canadian Centre for Cyber Security lists prompt patching among its baseline controls. In Quebec, Law 25 requires keeping a register of confidentiality incidents. Notifying the Commission d’accès à l’information (Quebec’s access-to-information oversight body) is required only when such an incident presents a serious risk of harm: the publication of a vulnerability on its own doesn’t trigger any of these obligations.
What to do now
- Ask your IT provider today for the list of workstations and their Chrome version.
- Roll out version 157.0.8103.50 or newer everywhere, starting with the workstations that handle client files and payments.
- Turn on automatic updates, then check two weeks later that it actually worked.
- Give your teams a short heads-up: an unexpected link should be verified by phone before it’s opened.
- Write down who, on your team, is responsible for applying patches. Without a name attached, the task doesn’t exist.
FAQ
Should we stop using Chrome?
No. The NVD listing states that the fix ships in version 157.0.8103.50. The useful move isn’t switching browsers, it’s confirming that this version is installed everywhere, including on laptops that rarely get turned on.
Nobody has attacked us: is this really urgent?
The NVD listing reports no exploitation so far. That doesn’t mean the risk is low: the vulnerability is publicly documented and a fix is available. There is no absolute protection, and no provider can guarantee zero risk; applying an available fix remains one of the simplest things you can do.
Are we too small to be a target?
This kind of issue doesn’t target anyone in particular: it depends on the version installed on the machine, not on how well-known the company is. A booby-trapped page acts on the corner store’s computer the same way it acts on the factory’s.
Sources
- CVE-2026-125347 listing, National Vulnerability Database · NIST, November 10, 2026
- Canadian Centre for Cyber Security: Baseline Cyber Security Controls for Small and Medium Organizations · baseline control checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-125347
Article prepared by RISS Canada’s monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed according to our editorial standards.
