Chrome 157 fixes seven critical bugs. Push it and make browsers restart

Google moved Chrome 157 to the stable channel on Tuesday with 213 security fixes. Seven are rated critical, and most of those could let a booby-trapped web page run code outside Chrome’s sandbox.

Google has not flagged any of them as exploited. The catch is the rollout: Google says the update arrives “over the coming days/weeks,” and it only takes effect once the browser restarts.

Chrome 157 fixes 213 security bugs, seven of them critical. It does nothing until the browser restarts.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Chrome 157 lands with seven critical fixes

Chrome 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and Mac shipped on November 3, alongside Chrome 157.0.8103.38 for Android. Google lists 213 security fixes, 77 of them rated high and seven critical.

The critical bugs are a buffer overflow in Dawn (CVE-2026-121156), memory corruption in ANGLE (CVE-2026-121229), use-after-free bugs in WebGL, Prerender, Geometry and Core (CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126) and a second Dawn overflow (CVE-2026-121247). Their CVE records say all but the Geometry bug could let a remote attacker run code outside the sandbox through a crafted HTML page.

Every Chrome install below 157.0.8103.38

Every desktop browser below 157.0.8103.38 is in scope. On Android, the CVE records for three of the critical bugs, in ANGLE, WebGL and one of the Dawn fixes, name Chrome on Android specifically, so phones need the Play Store update too.

Companies on the Extended Stable channel get 156.0.8078.88 for Windows and Mac instead. Other Chromium-based browsers ship these fixes on their own schedules.

Push 157 and make people restart

• Check chrome://settings/help on a few machines, or your endpoint inventory, for 157.0.8103.38 or later.
• In Chrome Browser Cloud Management or Group Policy, set a relaunch deadline with the RelaunchNotification and RelaunchNotificationPeriod policies so the update applies within a day or two.
• Push Chrome 157 for Android through your MDM or Google Play to managed phones.
• Ask the owners of Edge, Brave or other Chromium browsers in your fleet when their builds with these fixes ship.

Details

• Versions: desktop 157.0.8103.38 (Linux), 157.0.8103.38/.39 (Windows, Mac); Android 157.0.8103.38; Extended Stable 156.0.8078.88 (Windows, Mac).
• Critical: CVE-2026-121156 and CVE-2026-121247 (Dawn), CVE-2026-121229 (ANGLE), CVE-2026-121246 (WebGL), CVE-2026-121035 (Prerender), CVE-2026-121203 (Geometry, code execution inside the sandbox), CVE-2026-121126 (Core).
• Researchers: SecurityOnline counts 38 of the 84 critical and high bugs as reported by Google’s own teams. The largest listed rewards, $10,000 each, went for the Dawn overflow CVE-2026-121156 and a BackgroundFetch authorization bug (CVE-2026-121107).
• Exploitation: none noted in Google’s release post.

Hunt / verify

• Sort your inventory by Chrome version and last restart. Machines that stay asleep for weeks are usually the ones still on 156.
• Look for users who turned off auto-update or run portable copies of Chrome outside managed paths.

Source: Chrome 157 stable release; SecurityOnline summary

Sources

• Chrome Releases: Stable Channel Update for Desktop (November 3, 2026)
• Chrome Releases: November 2026 (Chrome for Android and Extended Stable updates)
• SecurityOnline: Chrome 157 Fixes 213 Flaws
• CVE.org: CVE-2026-121156

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].