Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities

Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security bugs, including seven rated critical. Announced on November 3, 2026, the update addresses flaws across graphics, memory handling, browser features, and access controls. Google says the stable release will reach users over the coming days and weeks.

The patched versions are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and macOS. The release follows another large patch cycle covered in Cybersecuritynews.com’s report on Chrome 156 fixing 353 security flaws, showing the continued need to keep browser updates current.

Seven Critical Flaws Affect Memory Safety

Two critical vulnerabilities involve buffer overflows in Dawn, Chrome’s implementation of the WebGPU graphics standard. CVE-2026-121156 was reported by Zhenpeng “Leo” Lin at depthfirst on September 30, earning a $10,000 reward.

Google reported the second Dawn flaw, CVE-2026-121247, on October 3. A buffer overflow happens when software writes beyond the memory space set aside for data.

Another critical issue, CVE-2026-121229, involves memory corruption in ANGLE. Researcher @mfx reported it on September 17 and received $1,000. Graphics-related security flaws have appeared in earlier releases, including the Chrome update fixing critical WebGL and Dawn vulnerabilities. These repeated fixes make graphics components an important area for browser security work.

The remaining four critical bugs are use-after-free flaws. They affect WebGL through CVE-2026-121246, Prerender through CVE-2026-121035, Geometry through CVE-2026-121203, and Core through CVE-2026-121126. This type of flaw occurs when software keeps using memory after it has been released. Depending on the circumstances, attackers may manipulate that memory, although the release notes do not explain specific attack methods.

Google’s official Chrome release announcement credits its own researchers for the WebGL issue. Xinyang Ge reported the Prerender and Geometry flaws, while Wenbin Liu reported the Core vulnerability. The Prerender entry specifically credits Ge at Anthropic, assisted by Claude. That credit documents AI-assisted research, but does not establish that the finding was fully automated.

The update also patches high-severity issues beyond those seven critical bugs. These include incorrect authorization in BackgroundFetch, out-of-bounds memory access in ANGLE, type confusion in V8, and memory flaws in PDFium, Media, and other components. This wider coverage matters because browser security depends on many connected systems, not just the code that displays web pages.

Google has not stated in this announcement that these vulnerabilities are being used in active attacks. It also does not provide proof-of-concept exploits or detailed attack chains.

Readers should therefore distinguish the confirmed severity ratings from claims of confirmed code execution, sandbox escape, or complete device compromise. Those outcomes are not established by the published advisory.

Users and IT teams should prioritize installing the patched release and confirming that browsers actually run the updated version. Google is keeping some technical details restricted until most users receive fixes.

Restrictions may remain longer when shared third-party libraries are affected. The Chromium Security page explains its coordinated disclosure process and why access to sensitive bug information is limited.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Google Releases Major Chrome Security Update Fixing 213 Bugs, Including 7 Critical Vulnerabilities appeared first on Cyber Security News.