Skip to content
audiotale.net
Sign in
NewsNews

Chrome 157.0.8103.38: 213 security fixes, 7 Critical, update now

Google's 3 November Chrome 157 release fixes 213 security bugs, including seven Critical, and Extended Stable gets 156.0.8078.88 with 55 fixes.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Google promoted Chrome 157 to the stable channel on 3 November 2026 with 213 security fixes, seven of them rated Critical. The desktop build is 157.0.8103.38 on Linux and 157.0.8103.38/.39 on Windows and Mac, and it rolls out "over the coming days/weeks" according to Google's release post. If you use Chrome, the practical step is to open the browser's About page, let it fetch the update and restart. Organisations on the Extended Stable channel got a separate build, 156.0.8078.88, with 55 fixes of its own.

Key points

  • Chrome 157.0.8103.38 (Linux) and 157.0.8103.38/.39 (Windows, Mac) reached the stable channel on 3 November 2026 with 213 security fixes.
  • By severity the 213 fixes split into 7 Critical, 77 High, 75 Medium and 54 Low, according to our count of the entries in Google's post.
  • Two of the Critical bugs are in Dawn, Chrome's WebGPU layer: CVE-2026-121156 and CVE-2026-121247. Others sit in ANGLE, WebGL, Prerender, Geometry and Core.
  • Extended Stable moved to 156.0.8078.88 for Windows and Mac with 55 security fixes, and Chrome 157 for iOS (157.0.8103.37) is on its way through the App Store.
  • Google's post does not say any of these bugs is being exploited in the wild.

What to do

  • Who is affected: anyone running Chrome 156 or earlier on Windows, macOS or Linux. Chromium-based browsers carry the same upstream code, so they will need their own updates; check your browser vendor's release notes, because we have not confirmed their timing.
  • Fixed version: Chrome 157.0.8103.38 (Linux) or 157.0.8103.38/.39 (Windows, Mac). On iOS, Chrome 157.0.8103.37. Extended Stable users should be on 156.0.8078.88.
  • How to update: open chrome://settings/help. Chrome checks for the update, downloads it and shows a Relaunch button. An update that has downloaded but not been applied does not protect you until you relaunch.
  • How to check: the same page prints the installed version. If it starts with 157.0.8103 (or 156.0.8078.88 on Extended Stable), you have the fixes.
  • Workaround: Google's post lists none. For managed fleets, push the update through your normal browser management channel and ask users to restart.
  • Rollout timing: Google says the release reaches users gradually, so the update may not appear on your machine on day one. Google's post does not give a schedule.

What happened

Google's Chrome Releases blog posted the Stable Channel Update for Desktop on 3 November 2026, announcing "the promotion of Chrome 157 to the stable channel for Windows, Mac and Linux". The post says the update "includes 213 security fixes" and lists each one with its internal bug number, severity, CVE identifier, component, the researcher credited and the date it was reported.

The seven Critical entries are:

  • CVE-2026-121156, a buffer overflow in Dawn, reported by Zhenpeng (Leo) Lin at depthfirst on 30 September 2026. Google lists a $10,000 reward.
  • CVE-2026-121229, memory corruption in ANGLE, reported by the researcher known as @mfx on 17 September 2026, with a $1,000 reward.
  • CVE-2026-121246, a use after free in WebGL, reported by Google on 8 September 2026.
  • CVE-2026-121035, a use after free in Prerender, credited to Xinyang Ge (Anthropic), "assisted by Claude", reported on 28 September 2026.
  • CVE-2026-121247, a buffer overflow in Dawn, reported by Google on 3 October 2026.
  • CVE-2026-121203, a use after free in Geometry, reported by Xinyang Ge on 7 October 2026.
  • CVE-2026-121126, a use after free in Core, reported by Wenbin Liu on 8 October 2026.

Reward amounts are only given for some entries. Several show "N/A" (including every Google-reported bug, as the post lists them) and some show "TBD", which means a decision had not been published when the post went up. Among the High-severity entries, the largest listed reward we saw is $10,000 for CVE-2026-121107, an incorrect authorization bug in BackgroundFetch reported by Johan Carlsson on 19 February 2026. That report date is a reminder that some of the fixed bugs are old: one Low-severity entry, CVE-2026-121209 (UI misrepresentation in Input), was first reported on 11 May 2020.

Alongside the desktop update, Google released Chrome Stable 157 (157.0.8103.37) for iOS, describing it as including "stability and performance improvements". Its post lists no security entries. On the same day the Extended Stable channel, which Google offers to organisations that want a slower update cadence, moved to 156.0.8078.88 for Windows and Mac. That post lists 55 security fixes: three Critical (CVE-2026-118306, CVE-2026-121156 and CVE-2026-76024), 49 High, two Medium and one Low by our count of its entries. The overlap matters: CVE-2026-121156, the $10,000 Dawn bug, is fixed in both branches, so staying on Extended Stable does not leave you exposed to it.

Background

Chrome's stable channel gets a new major version every few weeks (154 on 22 September, 156 on 20 October, 157 on 3 November), and each major release is followed by a run of smaller point updates. Looking back through Google's release blog shows how the security-fix counts have moved:

  • Chrome 154 was promoted on 22 September 2026 with 108 security fixes, followed by point updates of 32 (29 September) and 11 (1 October).
  • Chrome 156 was promoted on 20 October 2026 with 353 security fixes, followed by point updates of 52 (27 October) and 21 (29 October).
  • Chrome 157, promoted on 3 November, has 213.

We left out Chrome 155 because we did not read its promotion post in the same detail. The pattern in the posts we did read is that a major release carries a large batch of fixes and the weekly updates after it carry fewer. A big count therefore does not by itself mean the browser got less safe: it mostly reflects bugs that were found and fixed during the development cycle before the release reached users. Google's note says as much, thanking researchers who "worked with us during the development cycle to prevent security bugs from ever reaching the stable channel", and says many bugs are caught by tools such as AddressSanitizer, MemorySanitizer, libFuzzer and AFL.

Dawn and ANGLE, which account for three of the seven Critical entries here, are the graphics layers behind WebGPU and WebGL: they translate web page requests into calls to the GPU driver. They are complex, run code that handles untrusted input, and are a regular source of memory-safety bugs. Memory bugs such as buffer overflows and use after free are the class that tends to earn a Critical rating, because in the worst case a web page can corrupt memory in a browser process.

The numbers

Chrome security fixes in each major release's first stable postsecurity fixes
Chrome security fixes in each major release's first stable post (security fixes)
security fixes
Chrome 154108
Chrome 156353
Chrome 157213

Source: Google Chrome Releases blog (Chrome 154, 156 and 157 stable posts)

Chrome 157 security fixes by severityfixes
Chrome 157 security fixes by severity (fixes)
fixes
High77
Medium75
Low54
Critical7

Source: Google Chrome Releases blog, Stable Channel Update for Desktop, 3 November 2026 (our count of the entries)

What it means

For ordinary users the answer is short: update and restart. A browser is the program that opens untrusted content all day, and a release with seven Critical entries is one to apply promptly even though Google reports no exploitation.

For IT teams, the mix of channels is the useful detail. Extended Stable administrators get 55 fixes on a 156 base, including the Dawn bug, so the extended channel is patched too; the difference is that Extended Stable stays on the 156 line while the main channel moves to 157. Teams that pin versions should check that their policy does not hold the browser back from this update.

For developers building on Chromium (Electron apps, embedded browsers, other browsers), the same upstream fixes need to be merged. Because Google restricts bug details until most users are updated, downstream projects may be patching with less information than the public eventually gets.

The credit lines are also a small sign of how bug finding is changing. One of the Critical bugs is credited to an Anthropic researcher "assisted by Claude", and another Critical to the same person without that note. Google's post does not say how the assistance worked, so we cannot say more than that the credit line exists.

What we don't know yet

  • Whether any of the 213 bugs was exploited before the fix. Google's post does not mention exploitation; it also usually keeps bug details restricted until most users have updated.
  • When the update will reach every user. Google only says "coming days/weeks".
  • What Chromium-based browsers will ship and when. We did not find their notes for this release.
  • Whether Android will get the same build on the same schedule; the posts we read cover desktop and iOS.
  • The reward amounts marked "TBD", and the details of the bugs whose pages are still restricted.

What to watch next

Expect point updates to Chrome 157 over the next weeks, as happened after Chrome 156 (353 fixes on 20 October, then 52 and 21 in later updates). If any later post marks a bug as exploited in the wild, that changes the urgency. Watch your browser vendor's advisories if you use a Chromium derivative, and check that managed machines report 157.0.8103 or, on Extended Stable, 156.0.8078.88.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next