Google has released Chrome 157 for Windows, macOS, and Linux, and the update fixes 213 security bugs, including seven that are rated critical. The stable release will reach users over the coming days and weeks, and the patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS.
Seven critical flaws in browser graphics code
Two of the critical vulnerabilities are buffer overflows in Dawn, Chrome’s implementation of the WebGPU graphics standard. CVE-2026-121156 was reported by Zhenpeng “Leo” Lin at depthfirst on September 30, and the report earned a $10,000 reward. Google says the second Dawn flaw, CVE-2026-121247, was reported on October 3. A buffer overflow happens when software writes beyond the memory space set aside for data.
Another critical issue, CVE-2026-121229, affects ANGLE and involves memory corruption. Researcher @mfx reported it on September 17 and received $1,000. Google’s release notes also describe four use-after-free flaws as critical, covering WebGL through CVE-2026-121246, Prerender through CVE-2026-121035, Geometry through CVE-2026-121203, and Core through CVE-2026-121126. In this type of flaw, software keeps using memory after it has been released, and the release notes say attackers may manipulate that memory depending on the circumstances, while giving no specific attack method.
The announcement credits Google’s own researchers for the WebGL issue. Xinyang Ge reported the Prerender and Geometry flaws, while Wenbin Liu reported the Core vulnerability. The Prerender entry credits Ge at Anthropic and says Claude assisted, which documents AI-assisted research without showing that the finding was fully automated.
What the update covers beyond the critical bugs
The release also patches high-severity issues outside the seven critical findings. Google lists incorrect authorization in BackgroundFetch, out-of-bounds memory access in ANGLE, type confusion in V8, and memory flaws in PDFium, Media, and other components. Those fixes cover more than the code that displays web pages, since browser security depends on several connected systems.
Google does not say in the announcement that the vulnerabilities are being used in active attacks. It also does not provide proof-of-concept exploits or detailed attack chains. The published advisory does not establish confirmed code execution, sandbox escape, or full device compromise, even though it gives severity ratings for the bugs.
Earlier Chrome patch cycle and disclosure limits
The new release follows another large patch cycle, when Chrome 156 fixed 353 security flaws. That earlier round included critical WebGL and Dawn vulnerabilities, which the article cites as part of a pattern of repeated fixes in graphics components. Google says it is keeping some technical details restricted until most users receive the fixes.
Restrictions can last longer when shared third-party libraries are involved. The Chromium Security page describes the coordinated disclosure process and explains why sensitive bug information stays limited for a time.
Licensed under CC BY-ND 4.0 International