Google Chrome 157 Released With 213 Security Fixes, Including 7 Critical Vulnerabilities

Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security vulnerabilities, seven of which are classified as critical. This update, announced on November 3, 2026, addresses issues related to graphics, rendering, JavaScript execution, permissions, and browser infrastructure. Google noted that it will continue distributing this update over the coming days and weeks.

The patched builds are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. According to Google’s release announcement, access to certain bug details remains restricted until most users receive fixes. Restrictions may also remain when affected third-party libraries require coordinated remediation across dependent projects.

Seven Critical Vulnerabilities Patched

The highest-severity fixes comprise two buffer overflows in Dawn, memory corruption in ANGLE, and four use-after-free vulnerabilities affecting WebGL, Prerender, Geometry, and Core. These categories place memory handling at the center of the release’s most serious disclosed issues, although Google provides no detailed exploitation prerequisites in its announcement.

Critical CVE	Component	Vulnerability
CVE-2026-121156	Dawn	Buffer overflow
CVE-2026-121229	ANGLE	Memory corruption
CVE-2026-121246	WebGL	Use after free
CVE-2026-121035	Prerender	Use after free
CVE-2026-121247	Dawn	Buffer overflow
CVE-2026-121203	Geometry	Use after free
CVE-2026-121126	Core	Use after free

Google awarded $10,000 to Zhenpeng “Leo” Lin at depthfirst for reporting CVE-2026-121156 and $1,000 to researcher @mfx for CVE-2026-121229. Xinyang Ge of Anthropic reported the Prerender issue, CVE-2026-121035, with assistance from Claude, highlighting AI-assisted vulnerability discovery in this release. Other critical reports credit Google, Xinyang Ge, and Wenbin Liu.

The graphics-related fixes follow earlier Dawn and WebGL security patches, which also addressed critical memory-safety defects. However, component overlap does not establish that the newly disclosed vulnerabilities share an exploit chain or underlying root cause with previous issues.chromereleases.

Counting the individually listed CVEs produces seven critical, 77 high, 75 medium, and 54 low-severity vulnerabilities, matching Google’s stated total of 213 security fixes. The following grouping reflects the release notice’s severity classifications rather than independent exploitability assessments.

CVE severity group	Number
Critical	7
High	77
Medium	75
Low	54
Total	213

High-severity fixes include V8 type confusion, PDFium memory-safety flaws, authorization weaknesses in BackgroundFetch and FileSystem, and use-after-free defects across rendering and interface components.

Google also credits OpenAI Codex Security and Claude-assisted researchers for multiple reports. The breadth extends beyond graphics into document processing, scripting, navigation, and sensitive browser functionality.

Earlier V8 security updates illustrate the continuing importance of JavaScript-engine maintenance. For this release, however, Google does not state that any listed vulnerability is actively exploited; the critical ratings should not be presented as confirmation of ongoing attacks.

Users can check Help > About Google Chrome, install the available update, and relaunch when prompted. Administrators should prioritize deployment and verify installed versions across managed endpoints. Because rollout is gradual, confirming the patched build provides stronger assurance than assuming every installation has already updated automatically.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.