# Chrome 157 fixes 213 security bugs, 7 of them critical (none known exploited) · pwn.watch

> Google promoted Chrome 157 to the stable channel on Nov 3 2026 (157.0.8103.38 on Linux, 157.0.8103.38/.39 on Windows and Mac) with 213 security fixes. Seven are rated critical: buffer overflows in Dawn (CVE-2026-121156, CVE-2026-121247), memory corruption in ANGLE (CVE-2026-121229), and use-after-free bugs in WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203) and Core (CVE-2026-121126). Many of the high-severity bugs were credited to AI-assisted research from Anthropic and OpenAI Codex Security. Google has not said any are exploited. The rollout is staged over days or weeks, so update and relaunch rather than waiting.

Page: https://pwn.watch/i/chrome-157-security-update-nov-2026 · generated 2026-11-04T12:20:10.542Z

## Status
- Severity: high · status: live · patch: patched
- Product: Google Chrome (desktop)
- Started: 2026-11-03
- CVEs: CVE-2026-121156, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121247, CVE-2026-121203, CVE-2026-121126
- Affected: Chrome before 157.0.8103.38
- Fixed in: 157.0.8103.38/.39 (Windows, Mac); 157.0.8103.38 (Linux)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/chrome-157-security-update-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/chrome-157-security-update-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/chrome-157-security-update-nov-2026.json
- This file: https://pwn.watch/i/chrome-157-security-update-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-04: Hong Kong's GovCERT issues an alert telling users to update Chrome to 157.0.8103.38 or later, warning the flaws could allow remote code execution. (https://www.govcert.gov.hk/en/alerts_detail.php?id=2160)
- 2026-11-03: Chrome 157 promoted to stable with 213 security fixes, seven of them critical (Dawn, ANGLE, WebGL, Prerender, Geometry, Core); none reported exploited. (https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)

## Fix brief
# Security brief: Chrome 157 fixes 213 security bugs, 7 of them critical (none known exploited)

Source: https://pwn.watch/i/chrome-157-security-update-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 09:34 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Google promoted Chrome 157 to the stable channel on Nov 3 2026 (157.0.8103.38 on Linux, 157.0.8103.38/.39 on Windows and Mac) with 213 security fixes. Seven are rated critical: buffer overflows in Dawn (CVE-2026-121156, CVE-2026-121247), memory corruption in ANGLE (CVE-2026-121229), and use-after-free bugs in WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203) and Core (CVE-2026-121126). Many of the high-severity bugs were credited to AI-assisted research from Anthropic and OpenAI Codex Security. Google has not said any are exploited. The rollout is staged over days or weeks, so update and relaunch rather than waiting.

Severity detail: 7 critical and many high-severity memory-safety fixes; no known in-the-wild exploitation

- Product: Google Chrome (desktop)
- CVE / advisory ids: CVE-2026-121156, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121247, CVE-2026-121203, CVE-2026-121126

## Affected versions
- Chrome before 157.0.8103.38

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 157.0.8103.38/.39 (Windows, Mac)
- 157.0.8103.38 (Linux)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Update Chrome via Settings > About Chrome and relaunch; confirm 157.0.8103.38 or later (`google-chrome --version` on Linux). Chromium-based browsers (Edge, Brave, Opera, Vivaldi) ship their own updates.

## Latest updates
- Nov 4, 2026: Hong Kong's GovCERT issues an alert telling users to update Chrome to 157.0.8103.38 or later, warning the flaws could allow remote code execution.
- Nov 3, 2026: Chrome 157 promoted to stable with 213 security fixes, seven of them critical (Dawn, ANGLE, WebGL, Prerender, Geometry, Core); none reported exploited.

## Advisories
- [Stable Channel Update for Desktop (Chrome 157)](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html) (Google Chrome Releases)
- [Security Alert (A26-11-05): Multiple Vulnerabilities in Google Chrome](https://www.govcert.gov.hk/en/alerts_detail.php?id=2160) (GovCERT.HK)

---
Machine-readable: https://pwn.watch/i/chrome-157-security-update-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.