Google has rolled out Chrome version 157 for Windows, macOS, and Linux, equipped with fixes for 213 security vulnerabilities—including seven deemed critical. Released on November 3, 2026, this update spans flaws in graphics subsystems, memory handling, feature controls, and broader access permissions. Rollout of the stable versions will occur gradually over the coming days. Patch numbers are 157.0.8103.38 for Linux, and 157.0.8103.38/.39 for Windows and macOS.
Critical Bugs Focus on Memory Safety
Two of the critical vulnerabilities stem from buffer overflow issues in Dawn, Chrome’s WebGPU graphics implementation. One—CVE-2026-121156—was reported September 30, 2026, by a researcher who earned a $10,000 reward. Another (CVE-2026-121247) followed on October 3. A third critical issue, CVE-2026-121229, involves memory corruption in ANGLE, reported earlier in September and rewarded $1,000. These graphics-related flaws underscore a recurring security challenge for browser rendering systems.
The remaining four critical vulnerabilities are all use-after-free problems—where freed memory can still be manipulated. They affect WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203), and Core (CVE-2026-121126). Some were reported by Google’s own engineers, others by external researchers. Of note, the Prerender issue was identified by a researcher at Anthropic, assisted by an AI tool, which highlights growing roles for AI in vulnerability discovery.
More High-Severity Bugs and Best Practices
Besides the critical bugs, a wider collection of high-severity issues has been patched. These include authorization missteps in BackgroundFetch, out-of-bounds memory access in ANGLE, type confusion in V8 (Chrome’s JavaScript engine), and various memory flaws across PDFium, Media, and related components. Although none of the vulnerabilities are confirmed to be under active exploit, Google doesn’t provide proof-of-concept code or full attack chains in the release materials.
Users and system administrators are advised to install the update promptly and ensure browsers are running the new build. Details about certain bugs remain limited until most users have updated, especially when vulnerabilities involve shared libraries. The Chromium security disclosure process is invoked to explain this cautious approach.
What this means: With WebGPU, WebGL, ANGLE, V8 and other core components repeatedly showing up in vulnerability reports, graphics and memory safety continue to be major weak points. Expect future patches to keep focusing here. Enterprises should track the exposure of these bugs in their environments, and users should enable automatic updates to avoid falling behind.
