Google has promoted Chrome 157 to the stable channel for Windows, Mac and Linux with 213 security fixes, seven of which the company rates Critical. None is flagged as exploited in the wild, but the update rolls out over days and weeks, so plenty of browsers are still running the previous version.
The desktop build is 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and Mac, according to Google's release notes published on November 3. Chrome for Android also moved to 157.0.8103.38, as Malwarebytes points out in its breakdown of the release, and will reach Google Play over the coming days.
Seven critical bugs, almost all memory errors
Google's own severity split is 7 Critical, 77 High, 75 Medium and 54 Low. Google does not publish CVSS scores in its release notes, so the ratings below are Google's. The seven Critical entries, in Google's wording:
- CVE-2026-121229: memory corruption in ANGLE, Chrome's graphics translation layer. Reported by @mfx.
- CVE-2026-121035: use after free in Prerender, the feature that loads and renders a page in the background before you click. Reported by Xinyang Ge (Anthropic), assisted by Claude.
- CVE-2026-121203: use after free in Geometry. Reported by Xinyang Ge.
- CVE-2026-121126: use after free in Core. Reported by Wenbin Liu, who received a $10,000 reward.
- CVE-2026-121156: buffer overflow in Dawn, the engine behind WebGPU. Reported by Zhenpeng (Leo) Lin at depthfirst.
- CVE-2026-121246: use after free in WebGL. Found internally by Google.
- CVE-2026-121247: buffer overflow in Dawn. Found internally by Google.
A use after free is a bug where a program keeps using memory it has already released; a buffer overflow writes past the end of a block of memory. Both are classic routes to crashes and, in some cases, to running an attacker's code. Google keeps bug details restricted until a majority of users are updated, so the release notes say nothing about how any of these could be triggered.
Four of the seven sit in the graphics stack (ANGLE, Dawn twice and WebGL), a pattern that also dominated Chrome 154's critical list in September. Malwarebytes singles out the ANGLE flaw, which it says affects Chrome for Android and could potentially let a remote attacker run code outside the browser sandbox through a crafted HTML page. Code running outside the sandbox is no longer contained by the browser's own isolation, which is what makes that class of bug valuable to attackers.
Two of the critical bugs were credited to an Anthropic researcher, one of them explicitly found with the help of Claude, a small sign of AI-assisted bug hunting turning up in a mainstream browser's patch notes.
Relaunch onto 157.0.8103.38 or later
Chrome downloads updates on its own but only applies them after a restart, and a browser that is never closed can sit on an old version for weeks. To check, open Settings, then About Chrome (or Help, then About Google Chrome), let it look for the update and click Relaunch. Windows and Mac users should end up on 157.0.8103.38 or .39, Linux users on 157.0.8103.38. Android users can update from Google Play once the build arrives.
This follows last month's Chrome 156 and Firefox 159 releases. None of the seven critical bugs is reported as exploited, and that is the argument for relaunching today rather than next week: Google lifts the restriction on bug details once most users are patched, and a browser still on version 156 at that point is on the wrong side of the disclosure.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.