Google has rolled out a major Chrome update addressing 83 security vulnerabilities across Windows, macOS, and Linux platforms. Among these, five are labeled critical and involve use-after-free bugs that could enable remote code execution (RCE) if exploited. The stable channel moves to version 157.0.8103.78/.79 on Windows and Mac, while Linux users receive version 157.0.8103.78. The rollout will reach all users in the coming days.
Critical Bugs & Key Affected Components
The five critical vulnerabilities involve the ServiceWorker, CSS, Layout, Skia, and Accessibility subsystems. Each of them is the result of use-after-free conditions—scenarios in which Chrome retains access to memory that’s already been freed. Such mistakes can lead to program crashes, data corruption, or, in worst cases, the execution of malicious code. While Google has not reported any active exploits tied to these flaws, the potential risk is high enough that all users are urged to update.
The critical bugs are catalogued under CVE-2026-126885 (ServiceWorker), CVE-2026-126895 (CSS), CVE-2026-126879 (Layout), CVE-2026-126846 (Skia), and CVE-2026-126911 (Accessibility). Beyond these, 78 high-severity issues are also patched—covering a wide range of defect types such as buffer overflows, out-of-bounds memory access, type confusion, missing authorization controls, and information leaks. Components affected include V8, FileSystem, ANGLE, MediaStream, PDF functionality, Extensions, and SiteIsolation.
Detection, Disclosure & Update Advice
Several bug reports came in during October: Xinyang Ge flagged flaws in ServiceWorker, CSS, and Layout, while separate discoveries in November involved Skia and Accessibility, the latter submitted by Andrew Boni. Rewards for some reports remain pending. Google’s advisory makes clear that there’s no evidence of these vulnerabilities being exploited in the wild—yet.
To ensure safety, users should update Chrome immediately: open the browser menu, go to Help → About Google Chrome, check for updates, and restart when prompted. For enterprise or managed environments, it’s crucial to verify deployment across all machines rather than relying on automatic updates. Detailed disclosure practices, along with guidance for vulnerability reporting, are maintained through Google’s Chromium Security channels.
THIS PATCH follows a recent separate zero-day fix for an actively exploited XML flaw—though the two are unrelated. The current suite of 83 fixes focuses instead on preemptive risk closure rather than responding to observed attacks.
Google’s update is a reminder that memory safety bugs—especially use-after-free errors—remain a dangerous vector. Even without signs of active exploitation, critical flaws warrant rapid response. What to watch for next: whether any of these vulnerabilities begin showing up in real attack campaigns, and how the next updates tighten protection for memory management across Chrome’s core architecture.
