Originally published on proxymint.
Chrome XML zero-day CVE-2026-125350 is fixed in 157.0.8103.50. Auto-update skips headless Chrome in Playwright, Puppeteer and Docker. How to check yours.
TL;DR
- Check the browser version inside your containers, not on your laptop. Only the desktop install updates itself. Headless copies stay behind, and the build they need is Chrome 157.0.8103.50, which Google shipped on 9 November 2026 to fix CVE-2026-125350, a use after free in XML with an exploit in the wild.
- Puppeteer's latest release still ships a Chrome without the fix. v25.17.0, out on 10 November, rolled to 157.0.8103.38, a build below 157.0.8103.50. Install 157.0.8103.50 with @puppeteer/browsers and point executablePath at it.
- Playwright's bundled Chromium can't be called patched or unpatched yet. v1.65.0 ships Chromium 158.0.8127.18 from the Beta branch and Google hasn't said whether that build has the fix. Running channel: 'chrome' on an updated Chrome is the safe route.
- Extended Stable users want 156.0.8078.96. That build carries the same fix on Windows and Mac.
Key takeaways
- Pinned browsers are the exposure, not the updated laptop. Playwright, Puppeteer, Docker images and pinned Chrome for Testing builds all stay where they were when Google ships a fix.
- A scraping fleet is the worst place to run an old browser. It opens untrusted pages all day, and a proxy only changes the IP the site sees, not what the browser parses.
- Don't name the XML library until Google does. The bug is restricted, so any write-up that names one is guessing.
- Version checks need the exact number. Compare against 157.0.8103.50, or 156.0.8078.96 on Extended Stable, and treat a Beta-branch Chromium build as unconfirmed.
Read the full guide on proxymint, with the commands, tables and sources.
Top comments (0)