Chrome 157 ships 213 security fixes, seven of them critical

Chrome 157 ships 213 security fixes, seven of them critical

3 November 2026: Google has promoted Chrome 157 to the stable channel for Windows, Mac and Linux, as version 157.0.8103.38 on Linux and 157.0.8103.38 or .39 on Windows and Mac, with 213 security fixes. Seven of the fixes Google lists are rated critical. The update rolls out over the coming days and weeks, so managed fleets that wait for the automatic rollout will be exposed for longer than those that push it.

Not yet independently verified. Google itemises 116 of the 213 fixes and gives no CVSS scores; neither Google nor Mozilla says any of these flaws has been exploited. We will update this when it can be confirmed, and remove this note.

The critical seven

Google's post lists 116 of the 213 fixes; the rest are internal finds or are held back while users update. By our count of the listed ones, 7 are critical, 77 high and 32 medium. The critical flaws are:

• CVE-2026-121156 and CVE-2026-121247: buffer overflows in Dawn, Chrome's WebGPU implementation;
• CVE-2026-121229: memory corruption in ANGLE, the graphics translation layer;
• CVE-2026-121246: use after free in WebGL;
• CVE-2026-121035: use after free in Prerender;
• CVE-2026-121203: use after free in Geometry;
• CVE-2026-121126: use after free in Core.

Among the high-rated fixes, CVE-2026-121107, incorrect authorisation in BackgroundFetch, earned its reporter a $10,000 reward, as did the first Dawn overflow. Four of the seven critical bugs sit in the graphics stack, which processes content straight from web pages and is a frequent target.

Firefox 159.0.1 the same day

Mozilla shipped Firefox 159.0.1 on the same day with one fix, CVE-2026-120572, rated high: incorrect boundary conditions in the Layout: Block and Inline component, found by Mozilla itself (bug 2079035). It follows the larger Firefox 159 security release of 27 October.

Pushing the updates

Neither vendor says any of these flaws is being exploited, which leaves room for a normal patch cycle rather than an emergency one. For administrators:

• set Chrome's minimum version policy, or force the update through the management console, rather than waiting for the staged rollout;
• check that Chrome is actually restarted after the update, since a downloaded update does nothing until the browser relaunches;
• push Firefox 159.0.1 to desktops that run Firefox, including ESR users who should check whether their channel has a matching release;
• remember browsers bundled inside other products, such as Electron apps and kiosk builds, which update on their vendors' timetable, not Google's.

Chrome 158 is already in beta and is due for its early stable release, so the next round of fixes is not far behind.

Sources

• Chrome Releases: Stable Channel Update for Desktop (Chrome 157), 3 November 2026
• Mozilla Foundation Security Advisory 2026-123: Security vulnerability fixed in Firefox 159.0.1, 3 November 2026