Google shipped Chrome version 157 to the Stable channel on Nov. 3 with fixes for 213 security bugs, seven of them rated Critical, the company’s top severity tier. The build numbers are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and Mac, and the rollout is staged over days and weeks, so a given computer may not have the update yet.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Chrome applies updates quietly, but the fixes take effect only after the browser restarts. A window left open for days can keep running the old code.
The seven Critical bugs, one by one
Google’s desktop release notes list the Critical entries with their components. Two are in Dawn, the layer behind WebGPU: CVE-2026-121156, a buffer overflow, and CVE-2026-121247, another. CVE-2026-121229 is memory corruption in ANGLE, the graphics translation layer, and CVE-2026-121246 is a use-after-free in WebGL. CVE-2026-121035 is a use-after-free in Prerender, which loads pages in the background, while CVE-2026-121203 hits Geometry and CVE-2026-121126 hits Core, both use-after-free flaws.
Graphics code dominates the list. Dawn, ANGLE, WebGL and Geometry all sit close to the GPU path, which processes untrusted web content at high speed and has long been a rich hunting ground.
The reporting dates show how fast the pipeline moved. The seven Critical bugs were reported between Sept. 8 and Oct. 8, so the gap from report to a shipping fix ran from about four weeks to about eight. Use-after-free bugs, the most common type in the list, happen when code keeps using memory after the program has released it, and attackers who control what lands there can sometimes steer the browser. Buffer overflows and memory corruption work on similar principles, which is why Google treats them as the most severe class.
The ANGLE flaw on Android and the sandbox problem
Malwarebytes singled out CVE-2026-121229, the ANGLE bug, because it also affects Chrome for Android. Per Google’s description as relayed by Malwarebytes, it could let a remote attacker run code outside the browser’s sandbox through a crafted HTML page. The sandbox is the wall that normally keeps a compromised web page from touching the rest of the device, so an escape is the step that turns a browser bug into a device compromise. Android users get the same 157.0.8103.38 build through Google Play, in the days after the desktop release, per Google’s Android release post.
Google’s notes do not describe active attacks. Nothing in the material read on Nov. 7 says any of the 213 fixed bugs was exploited before the patch.
Who found them and what Google paid
Google credits outside researchers, and two of the Critical bugs carry bounties. Zhenpeng (Leo) Lin of depthfirst reported the Dawn buffer overflow CVE-2026-121156 on Sept. 30 and earned $10,000. A researcher using the handle @mfx reported the ANGLE flaw on Sept. 17 for $1,000. Xinyang Ge of Anthropic reported the Prerender bug CVE-2026-121035 with assistance from an AI model, and also the Geometry flaw. Google’s own staff found the WebGL and second Dawn bugs.
The release notes also credit OpenAI Codex Security, Team Allied and Hyeonjun Ahn among many others, and list a $10,000 High-severity award to Johan Carlsson. The notes put 75 of the fixes at High severity, 80 at Medium and 40 at Low, counts derived from the list itself.
The Dawn entries deserve a note for readers who have not met the term. WebGPU is the interface that lets web pages use a computer’s graphics chip directly for rendering and computation, and Dawn is the code that implements it inside Chrome. Two Critical bugs in that one component, one of which Google’s own engineers found, show how much new attack surface arrives with each capability a browser adds. Prerender, the subject of the third high-profile entry, loads pages in advance so they open instantly, which means flawed code can run before a person has even clicked.
Applying the patch takes a minute. Chrome’s menu leads to Help and About Google Chrome, where the browser checks for the update and shows a Relaunch button, as Google’s update instructions describe. Enterprise administrators can push the new build through their usual channels, and the Chrome Releases blog is where any later point release will appear.
The credit list also shows how bug hunting is changing. Two of the named reporters acknowledge AI assistance or tools: Anthropic’s Xinyang Ge was assisted by an AI model on the Prerender report, and the notes name OpenAI Codex Security among the credited sources. Google lists no bounty for the Critical bugs found by its own staff, and no payout for several others, so the published bounty amounts cover only a slice of the 213 fixes.
Desktop administrators should note the version string. A browser reporting 157.0.8103.38 or newer on Linux, or .38/.39 on Windows and Mac, carries the fixes, and anything older does not.
The unresolved part is exposure. With seven Critical bugs in a single drop and a staged rollout stretching across weeks, the gap between release and installation is the window attackers study.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
