Google has rolled out Chrome version 157 for multiple operating systems, including Windows, macOS, and Linux, addressing 213 security issues. Seven of these vulnerabilities are deemed critical, highlighting the importance of maintaining updated software. Announced on November 3, 2026, this update aims to fix problems related to graphics, memory management, and browser access controls. The new version will gradually become available to users in the coming days and weeks.
Critical Vulnerabilities in Chrome 157
The latest update features patched versions 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. This release follows a significant prior update that addressed 353 flaws in Chrome 156, emphasizing the continuous need for browser security enhancements. These updates are crucial to protect users from potential security breaches.
Memory Safety Concerns Addressed
Among the most severe vulnerabilities are two buffer overflow issues within Dawn, Chrome’s WebGPU graphics standard implementation. The flaw CVE-2026-121156, reported by Zhenpeng “Leo” Lin, offered a $10,000 reward for its discovery. Google’s internal team identified another issue, CVE-2026-121247, shortly after. Buffer overflows occur when software writes beyond allocated memory, potentially leading to exploit opportunities.
Another critical issue, CVE-2026-121229, involves memory corruption within the ANGLE graphics engine. Reported by researcher @mfx, this vulnerability earned a $1,000 reward. Previous updates have also targeted graphics-related vulnerabilities, underscoring the persistent focus on enhancing browser graphics security.
Additional Critical Bug Fixes
The update also resolves four critical use-after-free bugs affecting WebGL, Prerender, Geometry, and Core components. These flaws occur when software continues to use memory after it has been freed, potentially allowing attackers to manipulate this memory. While the specific attack methods remain undisclosed, the update highlights the need for ongoing vigilance in browser security.
Beyond these critical issues, the update addresses high-severity vulnerabilities, such as incorrect authorization in BackgroundFetch and out-of-bounds access in ANGLE. These fixes are essential because browser security involves numerous interconnected components beyond the core web page rendering code.
Although Google has not indicated active exploitation of these vulnerabilities, users should prioritize updating their browsers to the latest version. Ensuring the application is correctly updated is vital for security. Google’s coordinated disclosure process limits technical details until the majority of users have received the necessary fixes, with some restrictions persisting when third-party libraries are implicated.
