VULNpocalypse
CriticalVulnerabilityPatch available

Chrome 157 fixes 213 security bugs, 7 rated critical, in desktop and Android builds

Google released Chrome 157 with 213 security fixes, seven rated critical, and has not said any of them are exploited in the wild.

Published
Updated
Fixed in
Chrome 157.0.8103.38 (Linux), 157.0.8103.38/.39 (Windows and macOS), 157.0.8103.38 (Android)
Exploitation
No confirmed exploitation, Google’s announcement as reported by Cybersecuritynews does not state active attacks

Live scores

CVE-2026-121156
EPSS
0.004
low predicted chance of attack
VEDAS
0.599
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-121247
EPSS
0.004
low predicted chance of attack
VEDAS
0.605
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-121229
EPSS
0.004
low predicted chance of attack
VEDAS
0.607
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-121246
EPSS
0.004
low predicted chance of attack
VEDAS
0.596
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-121035
EPSS
0.004
low predicted chance of attack
VEDAS
0.601
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-121203
EPSS
0.003
low predicted chance of attack
VEDAS
0.599
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-121126
EPSS
0.004
low predicted chance of attack
VEDAS
0.600
likely exploited
On CISA KEV
Not listed
Detection rule
None yet

What happened

Google released Chrome 157 to the stable channel on November 3, 2026. The release covers Windows, macOS and Linux and includes 213 security fixes, seven of them rated Critical by Google. Google says the rollout will reach users over the coming days and weeks (Cybersecuritynews, Malwarebytes).

Patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. Malwarebytes also reports that Chrome for Android was updated to 157.0.8103.38 and will reach Google Play over the coming days (Malwarebytes).

The seven critical issues, as reported by Cybersecuritynews:

  • Buffer overflow in Dawn (Chrome’s WebGPU implementation): CVE-2026-121156. Reported by Zhenpeng “Leo” Lin at depthfirst on September 30, with a $10,000 reward.
  • Buffer overflow in Dawn: CVE-2026-121247. Reported by Google on October 3.
  • Memory corruption in ANGLE: CVE-2026-121229. Reported by @mfx on September 17, with a $1,000 reward.
  • Use-after-free in WebGL: CVE-2026-121246.
  • Use-after-free in Prerender: CVE-2026-121035. Credited to Xinyang Ge at Anthropic, assisted by Claude. Cybersecuritynews notes this documents AI-assisted research but does not show the finding was fully automated.
  • Use-after-free in Geometry: CVE-2026-121203. Reported by Xinyang Ge.
  • Use-after-free in Core: CVE-2026-121126. Reported by Wenbin Liu.

Cybersecuritynews also says the update fixes high-severity issues, including incorrect authorization in BackgroundFetch, out-of-bounds memory access in ANGLE, type confusion in V8, and memory flaws in PDFium and Media.

On impact, Malwarebytes quotes the ANGLE entry (CVE-2026-121229) as potentially letting a remote attacker execute arbitrary code outside the sandbox via a crafted HTML page, and says that flaw affects Chrome for Android. Cybersecuritynews cautions that the published advisory does not establish confirmed code execution, sandbox escape or full device compromise as outcomes. Both points are reported here as stated. Google has not stated in this announcement that any of these flaws are exploited in attacks, and no proof-of-concept exploits or attack chains are published. Google is keeping some bug details restricted until most users have the fixes (Cybersecuritynews).

The CVE.org record pages for CVE-2026-121229, CVE-2026-121035 and CVE-2026-121156 were supplied, but no record text was available in the material provided. Details beyond the news reports, such as CVSS scores and affected version ranges, are not confirmed.

Am I affected?

You are likely affected if you run desktop Chrome on Windows, macOS or Linux below 157.0.8103.38 (Windows and macOS: 157.0.8103.38/.39). Chrome for Android below 157.0.8103.38 is also in scope per Malwarebytes.

  • Chrome updates automatically, but you can lag if you never close the browser or if something such as an extension blocks the update (Malwarebytes).
  • Because the rollout is staged over days and weeks, a managed fleet may not have received it yet.
  • Impact on other Chromium-based browsers is not confirmed in the sources.

What to do now

  1. Open About Google Chrome from the settings or Help menu, let it check for updates, and click Relaunch to apply the update.
  2. Confirm the running version is 157.0.8103.38 or later (Windows and macOS builds show 157.0.8103.38 or .39; Linux shows 157.0.8103.38).
  3. For managed fleets, verify that browsers actually run the patched version rather than assuming auto-update worked, and prompt users who rarely restart Chrome to relaunch.
  4. Update Chrome for Android through Google Play once the build becomes available to you.
  5. Treat the update as high priority given the seven critical memory-safety flaws, even though exploitation in the wild is not confirmed.
  6. Check back for updated details, since Google restricts some bug information until most users are patched, and longer where shared third-party libraries are involved.

Sources