Chrome 157 is Google’s newest desktop browser release, and it patches 213 security bugs on Windows, macOS and Linux. Seven are rated critical, the highest severity Google uses, so it is worth updating the browser today rather than waiting for it to restart on its own.
Google announced it on 3 November and is rolling it out in stages, so your copy may not have it yet. To check, open the Chrome menu, go to Help, then About Google Chrome; the page checks for the update and asks you to relaunch. The fixed builds are 157.0.8103.38 on Linux and 157.0.8103.38 or .39 on Windows and Mac.
Two of the critical bugs are buffer overflows in Chrome’s WebGPU graphics component. A buffer overflow means a program writes past the memory set aside for it, which attackers can sometimes use to run their own code. According to a Cybersecurity News breakdown of the release notes, one of them was found by Zhenpeng “Leo” Lin of depthfirst and earned a $10,000 reward, while Google’s own researchers found the other.
The two are tracked as CVE-2026-121156 and CVE-2026-121247, and Google’s researchers reported the second on 3 October. A third critical flaw, CVE-2026-121229, is memory corruption in ANGLE, the layer that translates web graphics for the computer’s GPU. A researcher who goes by @mfx reported it and received $1,000. The other four critical bugs are use-after-free errors, where a program carries on using a piece of memory it has already given back. They sit in WebGL, Prerender, Geometry and Chrome’s core code.
The same breakdown notes that the Prerender entry credits Xinyang Ge of Anthropic, assisted by Claude. That shows AI tools were used in the research, but it does not mean the bug was found without human work.
Beyond the critical list, the update patches high-severity problems including incorrect authorization in BackgroundFetch, type confusion in the V8 JavaScript engine, and memory errors in PDFium and the media code. Google’s release notes do not say any of these flaws is being exploited in attacks, and Google usually keeps bug details restricted until most people have updated.
Chrome-based browsers such as Edge, Brave and Opera take the same Chromium fixes, but each ships them on its own schedule, so they need their own update check.
