Google releases Chrome 157 with 213 security fixes, seven rated critical
- Severity
- High
- Highest CVSS
- 9.6
- Exploited
- Not known
- Sources
- 2
What happened
Google shipped Chrome 157 to Stable on 3 November, with builds 157.0.8103.38/.39 for Windows and Mac, 157.0.8103.38 for Linux and Android, fixing 213 security issues including seven rated Critical. Critical CVE-2026-121229 is a memory corruption (buffer overflow) in ANGLE that could allow remote arbitrary code execution outside the sandbox via a crafted HTML page, and is noted as affecting Chrome for Android. Also highlighted: CVE-2026-121035 (use-after-free in Prerender) and CVE-2026-121156 (buffer overflow in Dawn, WebGPU). Defenders should push the fixed builds via managed update channels and confirm the version in use.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Update Chrome on Windows and Mac to 157.0.8103.38/.39, or on Linux to 157.0.8103.38.
- Update Chrome for Android to 157.0.8103.38 through Google Play once it becomes available.
- Open About Google Chrome from the settings or Help menu and click Relaunch to apply the update if it is available.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-121035CVSS 9.6Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-121156CVSS 9.6Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- CVE-2026-121229CVSS 9.6Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Full story timeline · 5 updates
- Tue 3 NovemberCVE-2026-121035 published, CVSS 9.6NVD
- CVE-2026-121156 published, CVSS 9.6NVD
- CVE-2026-121229 published, CVSS 9.6NVD
- Wed 4 NovemberChrome 157 Rolls Out With 213 Security Fixes, Seven Rated CriticalSecurityWeek
- Chrome 157 fixes 213 security issues, including 7 critical flawsMalwarebytes Labs
Who reported · 2 outlets
Who and what is in it
Companies
Products