Chrome 157 Security Update Fixes 213 Flaws, Including Seven Critical Bugs

TL;DR

Google has promoted Chrome 157 to the stable channel with 213 security fixes. This Chrome security update brings version 157.0.8103.38 to Linux and 157.0.8103.38/.39 to Windows and Mac. Seven of the flaws are rated critical.

Chrome 157 patches seven critical memory bugs in graphics and rendering code, plus 77 high-severity flaws. Google has not said any of them are exploited in the wild. Update now, since the release rolls out “over the coming days/weeks.”

Notable CVEs

Why It Matters

Critical Chrome bugs can let a malicious web page escape normal limits and run code. Moreover, 213 fixes is an unusually large batch for one release. Google’s own teams reported 38 of the 84 critical and high bugs it listed. The largest listed rewards were $10,000 each, for the Dawn overflow CVE-2026-121156 and a BackgroundFetch authorization bug.

AI tools also played a large role this time. Anthropic researchers, “assisted by Claude,” reported 12 of the listed bugs. OpenAI Codex Security found five more. For example, Xinyang Ge of Anthropic, working with Claude, found the critical Prerender flaw, CVE-2026-121035.

How the Attacks Work

Critical flaws

• CVE-2026-121156 and CVE-2026-121247: buffer overflows in Dawn, Chrome’s WebGPU engine
• CVE-2026-121229: memory corruption in ANGLE
• CVE-2026-121246: use after free in WebGL
• CVE-2026-121035: use after free in Prerender
• CVE-2026-121203: use after free in Geometry
• CVE-2026-121126: use after free in Core

In a use-after-free bug, code keeps using memory after the browser has released it. As a result, an attacker could plant data in that memory and hijack the program. Buffer overflows work in a similar way, by writing past the end of a memory block.

High-severity flaws

Use-after-free bugs make up 35 of the listed issues. In addition, the V8 JavaScript engine has 10 high-severity flaws, most of them type confusion bugs. Others hit PDFium, Skia, Media and FileSystem.

Affected Versions

All desktop builds before 157.0.8103.38 on Linux and before 157.0.8103.38/.39 on Windows and Mac are affected. Meanwhile, Extended Stable users move to 156.0.8078.88 on Windows and Mac.

Patch and Mitigation

Open Settings, then About Chrome, to apply the Chrome security update. Then restart the browser to finish installing it. Google keeps most bug details private “until a majority of users are updated with a fix.” Full release notes are in Google’s Chrome 157 stable channel update.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.