Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical

Hi, what are you looking for?

The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Google has promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities, including seven critical memory safety bugs.At the top of the list is a buffer overflow issue in Dawn, the open source and cross-platform implementation of the WebGPU standard. It earned the reporting researcher a $10,000 reward.The second is a memory corruption in the open source graphics engine abstraction layer ANGLE that was awarded a $1,000 bug bounty.No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.Per Google’sadvisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.Advertisement. Scroll to continue reading.The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

At the top of the list is a buffer overflow issue in Dawn, the open source and cross-platform implementation of the WebGPU standard. It earned the reporting researcher a $10,000 reward.The second is a memory corruption in the open source graphics engine abstraction layer ANGLE that was awarded a $1,000 bug bounty.No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.Per Google’sadvisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.Advertisement. Scroll to continue reading.The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

The second is a memory corruption in the open source graphics engine abstraction layer ANGLE that was awarded a $1,000 bug bounty.No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.Per Google’sadvisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.Advertisement. Scroll to continue reading.The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.Per Google’sadvisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.Advertisement. Scroll to continue reading.The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.Per Google’sadvisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.Advertisement. Scroll to continue reading.The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Per Google’sadvisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.Advertisement. Scroll to continue reading.The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related:Android’s November 2026 Updates Patch Over 200 VulnerabilitiesRelated:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related:Critical Node-RED Flaw Exploited in AttacksRelated:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 MillionRelated:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Rob T. Lee has joined Dragos as Chief AI Officer.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.