Two Exploited Flaws in Chrome and Outlook: What to Update Now

Most of us have learned to trust that software updates take care of themselves. Chrome updates quietly in the background, Microsoft 365 patches itself, and as long as nobody turns those features off, you’re covered. Most of the time, that’s true enough.

This week is a good example of where it falls short. On November 9, Google fixed a flaw in Chrome that attackers were already using. The next day, Microsoft fixed one in Outlook that was also being exploited, and the US Cybersecurity and Infrastructure Security Agency (CISA) added both to its catalog of vulnerabilities known to be exploited. Both fixes are out. But neither one actually protects a computer until it has been downloaded, installed, and finished, and that last step depends on someone relaunching a browser or closing Outlook.

Below we’ll walk through what each flaw does, why a computer with automatic updates can stay exposed for days, and how to check that yours are actually fixed.

What These Two Flaws Are

The Chrome flaw is tracked as CVE-2026-125350. (CVE stands for Common Vulnerabilities and Exposures, the public catalog security flaws are filed under.) It sits in the part of the browser that reads XML, a common format for data on the web. A web page built to trigger it can run the attacker’s own code inside the browser, and the only thing a person has to do is load that page, whether they got there from a link in an email, an ad, or a legitimate site that has itself been compromised. Google says it is aware that an exploit for this flaw exists in the wild.

Because Microsoft Edge, Opera, Brave, and many other browsers are built on the same open source Chromium code as Chrome, CISA notes that the flaw can affect them too. Each of those browsers gets the fix through its own update.

The Outlook flaw, CVE-2026-124194, is quieter but just as useful to an attacker. When someone opens a specially crafted message file, usually a .msg or .eml attachment, Outlook connects to a server the attacker controls without showing the usual warning about external content. Along the way it hands over a scrambled proof of the person’s Windows sign-in, an NT LAN Manager version 2 (NTLMv2) response, often called a hash. Attackers can do two things with it. They can try to crack it offline to recover the password, or, while the connection is still live, relay the sign-in exchange to another system that accepts NTLM and get in as that person. Microsoft confirms the flaw is being exploited. One piece of good news: Microsoft says the Preview Pane is not a way in, so the message file has to actually be opened.

Why an Automatic Update Isn’t the Same as Being Fixed

This is where “it updates itself” breaks down. Neither update finishes while people are working, and people are almost always working.

Chrome downloads an update in the background, but it keeps running the old version until the browser is relaunched. Plenty of people leave Chrome open for weeks with dozens of tabs, so a computer can have the fix downloaded and still be running the vulnerable version. Google also rolls each release out gradually “over the coming days/weeks,” so some computers won’t even have downloaded it yet unless someone checks.

Office works the same way. Microsoft 365 Apps can download an update and then wait for Outlook, Word, Excel, and the other apps to be closed before it can install. A laptop that sleeps each night instead of shutting down, with Outlook always open, can sit on the old version for a long time.

Then there are the computers that simply aren’t around: the laptop in a drawer, the machine of the person on vacation, the PC in the conference room nobody turns on. Each of those stays exposed until it comes back online and finishes the update.

How to Check Your Computers

Checking takes about a minute per computer, and the act of checking pushes the update along too.

1. Chrome. Open the three-dot menu, choose Help, then About Google Chrome. Let it download anything it finds, then click Relaunch. Chrome reopens your tabs afterward. You’re fixed once it shows version 157.0.8103.50 or later (157.0.8103.51 is also fixed on Windows and Mac).
2. Edge and other Chromium browsers. In Edge, open Settings, then About Microsoft Edge, and install whatever update it offers, then restart the browser. Do the same in Brave, Opera, or any other Chromium-based browser your team uses.
3. Outlook and the rest of Office. In Outlook, Word, or Excel, go to File, then Account (it may say Office Account), then Update Options, and choose Update Now. Close the Office apps when it asks so the update can finish. On Microsoft 365’s Current Channel, the one most small businesses use, the fixed release is Version 2610 (Build 20527.20196) or later. Other update channels have their own fixed builds, which Microsoft lists on its Microsoft 365 Apps update history page, and Update Now pulls the right one for your channel.
4. Perpetual Office licenses. Microsoft also fixed this flaw in Office LTSC 2024 and Office LTSC 2021, the one-time-purchase versions some offices use. They update the same way, through the Update Now button, and Microsoft lists their fixed builds on the security update guide for this CVE.

Habits That Help Next Time

1. Relaunch the browser when it asks. Chrome and Edge show a button or a colored dot when an update is waiting. Clicking it takes a few seconds and restores your tabs, and it’s the step that actually puts the fix in place.
2. Close Office at the end of the day. Quitting Outlook and the other apps before you leave gives Office the window it needs to finish installing updates. Restarting the computer once a week does the same for Windows.
3. Treat unexpected attachments with suspicion. This applies to more than just .msg and .eml files. If an attachment shows up that you weren’t expecting, even from someone you know, check with the sender another way before opening it.
4. Know which computers you have. It’s hard to confirm every machine is fixed if nobody has a current list. The old desktop in the back office is usually the one that gets missed.

What to Ask Your IT Team

If someone else looks after your computers, these questions will tell you quickly whether you’re covered.

• How do you know every computer is actually on the fixed version? The right answer comes from an inventory or management tool that reports the installed version of Chrome and Office on each machine, not from the assumption that automatic updates did their job. Ask how many computers are still on the old version and what happens to the ones that are offline.
• Are browsers set to prompt people to relaunch? Chrome and Edge both have policies, such as Chrome’s RelaunchNotification setting, that tell people when an update is waiting. The setting is a tradeoff. A recommended notice can be put off indefinitely, so it doesn’t guarantee the gap closes. A required relaunch does, but when its deadline passes the browser restarts on its own, even if someone is in the middle of something. A good middle ground is a required relaunch with a few hours’ notice, so people can finish what they’re doing and relaunch on their own schedule before the deadline.
• Does our firewall block outbound SMB to the internet? Server Message Block (SMB), the Windows file-sharing protocol that uses port 445, is one of the ways a Windows sign-in response gets sent to an outside server. Microsoft has long recommended blocking SMB to and from the internet at the firewall. It isn’t a substitute for the Outlook update, since attackers have other ways to make that connection, but it narrows the paths available to them.
• Are our administrator accounts protected from NTLM? If your office runs a Windows domain with Active Directory, Microsoft’s Protected Users security group can stop its members from signing in with NTLM, which takes the relay attack off the table for those accounts. There’s a catch: the domain controllers only reject NTLM for the group when the domain’s functional level is Windows Server 2012 R2 or later, and the group can exist on an older domain without doing that. Ask whether the accounts that can make changes across your systems are in it, whether the domain meets that level, and whether someone has confirmed NTLM sign-in actually fails for those accounts afterward. Test it first, since some older applications depend on NTLM.
• Are any of our computers too old to get these updates? Chrome stopped releasing updates for Windows 7, Windows 8.1, and Windows Server 2012 years ago, so a browser on one of those machines is stuck on an old, unpatched version for good. Ask for a plan to retire those machines, or at least remove Chrome from them.

The Bottom Line

Automatic updates do most of the work, but they don’t finish the job on their own, and with both of these flaws already in attackers’ hands, waiting for the next restart isn’t a plan. If you do only one thing today, open About Google Chrome on each computer and click Relaunch. Then close Office so its update can land, and be careful with unexpected attachments until everyone is up to date. If you’d like a hand confirming where your computers stand, get in touch.