Google promoted Chrome 157 to the stable channel for Windows, Mac, and Linux on November 3, 2026, in the latest Chrome security update, closing out 213 security issues in a single release. Seven of those fixes are rated Critical, and most of them sit in Chrome’s graphics stack: Dawn, ANGLE, and WebGL. The build lands as version 157.0.8103.38/.39 on Windows and Mac and 157.0.8103.38 on Linux, and it’s rolling out gradually, so not every installed copy of Chrome will update on the same day.
What the Critical Bugs Actually Affect
Of the seven Critical-rated flaws, four sit in the graphics rendering pipeline. CVE-2026-121156 and CVE-2026-121247 are buffer overflows in Dawn, the layer that implements WebGPU. CVE-2026-121229 is a memory corruption bug in ANGLE, the translation layer Chrome uses to map graphics calls onto a device’s native drivers. CVE-2026-121246 is a use-after-free in WebGL. The remaining three Critical bugs are use-after-free flaws in Prerender, Geometry, and Core, according to Google’s own Chrome Releases blog post.
Google is still withholding most technical detail, which is standard practice until a majority of users have updated or until a shared open-source dependency gets patched too. One detail worth noting: two of the seven Critical bugs, including the Prerender use-after-free (CVE-2026-121035), were reported by Google engineer Xinyang Ge with Claude credited as assisting in finding them, continuing a pattern from Chrome’s last few monthly releases where AI-assisted bug hunting has turned up a growing share of the critical finds. Beyond the Critical set, the release also patches 77 High-severity issues and a longer tail of Medium and Low bugs, mostly memory-safety problems in components like BackgroundFetch, Permissions, CacheStorage, and PDFium.
Who Should Care and What to Do
This affects anyone running desktop Chrome, and by extension most Chromium-based browsers (Edge, Brave, Opera, Vivaldi) once they pull the same fixes into their own release schedules. Chrome updates itself in the background, but the patch only takes effect after a restart. Check the installed version at chrome://settings/help; anything at 157.0.8103.38 or later counts as patched.
Seven Critical graphics-stack bugs in one release is a bigger batch than usual, and memory corruption flaws in Dawn, ANGLE, or WebGL are the kind of thing that gets reverse-engineered into working exploits once the fix details leak out. If your team or clients log into WordPress, Webflow, or any other CMS dashboard through Chrome, an outdated browser is a way in that has nothing to do with how well-patched the CMS itself is, on par with the urgency behind last week’s WordPress 7.1.4 release. Restarting the browser is a five-second fix; leaving seven Critical bugs sitting unpatched for weeks is not a risk worth carrying for that.
This follows Chrome 156’s update from just five days earlier, which patched a single Critical MediaStream bug among 21 total fixes. Chrome’s release cadence is fast enough that staying current, not trying to evaluate each individual CVE, is the realistic defense most people have.
