Chrome 157.0.8103.78 fixes 83 security bugs, five rated critical

Chrome 157.0.8103.78 fixes 83 security bugs, five rated critical

11 November 2026: Google has moved Chrome's desktop Stable channel to 157.0.8103.78/.79 on Windows and Mac and 157.0.8103.78 on Linux, with 83 security fixes. Five are rated critical, all use-after-free bugs, and the post reports no exploitation; it rolls out over "the coming days/weeks", so managed fleets should push it rather than wait.

Not yet independently verified. Google's post does not say whether any of the 83 bugs is exploited; the split of 78 high-rated fixes is our own count of the post, matched by iThome's. We will update this when it can be confirmed, and remove this note.

The five critical bugs

• CVE-2026-126885: use after free in ServiceWorker, reported by Xinyang Ge on 2 October
• CVE-2026-126895: use after free in CSS, reported by Xinyang Ge on 19 October
• CVE-2026-126879: use after free in Layout, reported by Xinyang Ge on 22 October
• CVE-2026-126846: use after free in Skia, found by Google on 2 November
• CVE-2026-126911: use after free in Accessibility, reported by Andrew Boni on 2 November

The other 78 fixes are rated high. V8 and Skia account for the largest groups among them; the first listed, CVE-2026-126864, a use after free in V8 reported by Jihyeon Jeong, earned a $4,000 reward. Google keeps bug details restricted until most users have the fix, so the post gives one line per bug and no technical write-ups.

Not the same as last week's Chrome 157 updates

This is the third security release on the Chrome 157 line. The first Stable release of 157 fixed 213 security bugs, seven of them critical, and 157.0.8103.50 fixed nine, including CVE-2026-125350, an XML use-after-free with an exploit in the wild. A browser that took either of those updates still needs this one; the fixes are cumulative, so going straight to 157.0.8103.78 covers all three.

Other channels updated the same day

• Chrome for Android: 157.0.8103.78
• Extended Stable for Windows and Mac: 156.0.8078.100, for organisations that update on the eight-week cycle
• ChromeOS LTS-150: 150.0.7871.289

Administrators on Extended Stable get the security fixes without the feature changes of 157. Check that the Extended Stable build carries the critical fixes before relying on it; Google's post for that channel lists its own set.

Browsers built on Chromium, such as Edge, Brave, Opera and Vivaldi, take these fixes in their own releases, usually within days. Their version numbers differ from Chrome's, so match on the Chromium base version each vendor publishes.

Sources

• Chrome Releases: Stable Channel Update for Desktop, 11 November 2026