Chrome Critical Use-After-Free Flaws Fixed in 157.0.8103.78

TL;DR

Google released Chrome 157.0.8103.78/.79 for Windows and Mac and 157.0.8103.78 for Linux, fixing 83 security flaws. This Chrome security update includes five Critical use-after-free bugs and 78 High-severity issues. That is an unusually large batch for a single Stable channel update.

Chrome 157.0.8103.78 patches 83 vulnerabilities, including Critical memory bugs in ServiceWorker, CSS, Layout, Skia and Accessibility. Google has not reported any exploitation. Update Chrome now and relaunch the browser.

Notable CVEs

Why It Matters

Use-after-free bugs in a browser often let attackers run code through a crafted web page. In addition, Critical-rated Chrome bugs can sometimes help an attacker escape the browser sandbox. Google lists no exploits in the wild for this release, unlike its November 10 update, which fixed the actively exploited zero-day CVE-2026-125350.

The update also shows how AI-assisted research is changing bug hunting. Several reports credit Anthropic researchers “assisted by Claude.” Others come from OpenAI Codex Security. Google’s own teams found most of the remaining bugs.

How the Attack Works

Critical bugs

All five Critical flaws are use-after-free errors. They sit in ServiceWorker (CVE-2026-126885), CSS (CVE-2026-126895), Layout (CVE-2026-126879), Skia (CVE-2026-126846) and Accessibility (CVE-2026-126911). In this bug class, Chrome keeps using memory after freeing it, so an attacker who controls that memory may hijack execution.

High-severity bugs

Many of the 78 High-severity flaws cluster in a few components. The V8 JavaScript engine accounts for 17 fixes, including type confusion bugs such as CVE-2026-126910. Another 17 fixes target the Skia graphics library. Meanwhile, ANGLE, Media, Extensions and FileSystem also received several fixes. Researcher Jihyeon Jeong earned the only disclosed bounty, $4,000, for the V8 use-after-free CVE-2026-126864.

As usual, Google is keeping bug details private. Access “may be kept restricted until a majority of users are updated with a fix.”

Affected Versions

• Chrome for Windows and Mac before 157.0.8103.78/.79
• Chrome for Linux before 157.0.8103.78

Patch and Mitigation

Open Settings, then About Chrome, and let the update download. Next, click Relaunch to apply it. Google says the rollout will take “days/weeks,” so check manually rather than waiting. Users of Edge, Brave and other Chromium browsers should apply their vendor’s matching Chrome security update when it ships.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.