Chrome 157 Stable Carries 213 Security Fixes, Seven Rated Critical, Including Two in Dawn and One Each in ANGLE and WebGL

Overview

Google has promoted Chrome 157 to the stable channel for Windows, Mac and Linux, according to the Chrome Releases blog, in a post dated Tuesday, November 3, 2026. The update “includes 213 security fixes,” and SecurityWeek reports that seven of them are rated critical.

What We Know

Versions and rollout. Google’s post lists Chrome 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and Mac, and says the release “will roll out over the coming days/weeks.” A separate Chrome Releases post for Android says Chrome 157 (157.0.8103.38) has been released for Android and will reach Google Play over the next few days. That post adds that Android releases contain the same security fixes as their corresponding desktop releases unless otherwise noted. Chrome 157 had been in beta since October 15, 2026, according to Chrome for Developers.

Severity breakdown. SecurityWeek says the update fixes seven critical memory safety bugs and 77 high-severity vulnerabilities. Counting the entries in Google’s advisory list, the Herald tallies 7 critical, 77 high, 75 medium and 54 low entries, which sum to 213. The medium and low counts are the Herald’s own tally rather than figures stated by Google or SecurityWeek.

The critical entries. Google’s advisory lists these seven critical entries:

• CVE-2026-121156, a buffer overflow in Dawn, reported by Zhenpeng (Leo) Lin at depthfirst, with a $10,000 reward.
• CVE-2026-121229, memory corruption in ANGLE, reported by @mfx, with a $1,000 reward.
• CVE-2026-121246, a use after free in WebGL, reported by Google.
• CVE-2026-121035, a use after free in Prerender, credited to “Xinyang Ge (Anthropic), assisted by Claude.”
• CVE-2026-121247, a buffer overflow in Dawn, reported by Google.
• CVE-2026-121203, a use after free in Geometry, reported by Xinyang Ge.
• CVE-2026-121126, a use after free in Core, reported by Wenbin Liu.

By the Herald’s own count, four of the seven critical entries are in Dawn (two), ANGLE or WebGL. SecurityWeek describes Dawn as “the open source and cross-platform implementation of the WebGPU standard” and ANGLE as “the open source graphics engine abstraction layer.” The advisory also lists a high-severity use after free in WebGPU, CVE-2026-121089, with its reward marked “TBD.”

Rewards and bug types. Per SecurityWeek, Google “handed out $31,000 in rewards to the reporting researchers” but had not determined the bounties for 39 of the flaws. The outlet lists the most common vulnerability types as incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19) and type confusion (13).

Exploitation. SecurityWeek writes that “Google makes no mention of any of these security defects being exploited in the wild,” while urging users to update as soon as possible.

What We Don’t Know

• Google’s advisory notes that access to bug details and links “may be kept restricted until a majority of users are updated with a fix,” so technical details of the critical entries are not yet public in the cited sources.
• The stable post points to upcoming Chrome and Chromium blog posts about new features delivered in 157, so the release’s developer-facing features are not covered in the sources cited here.
• Bounties for several entries are listed as “TBD,” and the sources do not say when they will be determined.

Next in the Pipeline

Separately, the Chrome Releases blog lists a Beta channel update to 158.0.8127.18 for Windows, Mac and Linux. That build is a beta pre-release and not a stable version.