Chrome 157 Security Update Patches 213 Vulnerabilities

Last updated: November 4, 2026

Google has promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities. Seven carry critical severity ratings, while 77 are classified as high severity, according to SecurityWeek.

The scale of the release makes prompt deployment the central issue for enterprises. Google did not report known exploitation of the listed flaws, but the patch closes seven critical memory safety defects and a much larger set of high-severity issues.

Chrome 157 release details

Chrome 157 is rolling out as versions 157.0.8103.38 and 157.0.8103.39 for Windows and macOS. Linux users are receiving version 157.0.8103.38.

The seven critical vulnerabilities consist of a Dawn buffer overflow, an ANGLE memory corruption issue, four use-after-free defects and one additional buffer overflow. Google reported two of the five issues not covered by the first two disclosures. Anthropic researcher Xinyang Ge reported two, while researcher Wenbin Liu reported the fifth.

The Dawn vulnerability received a $10,000 bounty, the largest disclosed reward. The ANGLE memory corruption issue received $1,000. No rewards were listed for the other five critical flaws.

Google also disclosed bounties for two high-severity vulnerabilities: $10,000 for an incorrect-authorization flaw and $2,000 for an out-of-bounds read.

What the bounty data does—and does not—show

Google said it paid $31,000 in rewards to researchers connected with the release. It had not yet determined bounties for 39 of the vulnerabilities. That incomplete payment status should not be interpreted as evidence that those flaws are unimportant.

Reward amounts also need to be separated from threat data. The $10,000 Dawn bounty was the largest disclosed payment, but bounty size does not establish whether a vulnerability is being exploited or how widely affected it may be. Google made no statement about any of the release’s security defects being exploited in the wild.

The vulnerability categories provide a more useful guide to the technical work included in the update. Google listed 51 incorrect- or missing-authorization defects, 45 use-after-free flaws, 19 UI misrepresentation issues, 13 type-confusion bugs, 13 information leaks, 11 out-of-bounds read or write defects, nine improper-input-validation issues and nine uninitialized-resource bugs.

This mix matters because the release is not limited to memory corruption. Authorization and validation defects appear alongside use-after-free, type-confusion and information-leak issues, making accurate browser version visibility an important part of the response.

Why prompt deployment matters

Chrome 157 should be treated as a priority update, but its significance should be stated precisely. Google disclosed seven critical memory safety flaws and 77 high-severity vulnerabilities, without reporting known exploitation.

For organizations that manage Chrome centrally, publishing the update is only the first step. The important question is whether managed endpoints actually received and started the new build. Organizations that block automatic updates face a direct trade-off: they gain more control over rollout, but they also own the risk of delaying access to the fixes.

Teams should also avoid using vulnerability counts as proof of an active attack campaign. A large patch total indicates substantial maintenance work, while the exploitation status remains the relevant warning signal for an active campaign.

Chrome 157 deployment decision checklist

• Confirm platform versions:** Verify that Windows and macOS systems are running 157.0.8103.38 or 157.0.8103.39, and that Linux systems are running 157.0.8103.38.
• Find outdated clients:** Use the organization’s browser inventory to identify systems that have not installed the stable release.
• Check deployment controls:** Review policies that block automatic updates and document any exception that could prevent Chrome 157 from reaching a device.
• Validate the running build:** Distinguish an update offered by the update service from a browser that has actually restarted into the patched version.
• Prioritize a short rollout:** Where compatibility testing is required, begin with a representative group while keeping the remaining deployment timeline brief.
• Track changing information:** Revisit Google’s advisory for changes in exploitation status and newly determined bounty awards.

What security teams should watch

The immediate signal to monitor is fleet coverage. Security teams need to know how many endpoints remain on earlier Chrome releases, particularly within managed environments where update exceptions may exist.

Exploitation status is the second signal. Any later Google disclosure of active exploitation would materially change the incident-response posture, but the current advisory contains no such report. Reward decisions for the 39 pending flaws may also clarify the distribution of research contributions, though they should not be used to infer threat severity.

The practical conclusion is straightforward: deploy Chrome 157 promptly, verify the running version across the fleet and continue watching Google’s advisory. That approach addresses the known defects without overstating what is known about active exploitation.

Key takeaways

• Chrome 157 patches 213 vulnerabilities, including seven critical and 77 high-severity issues.
• The critical flaws include two buffer overflows, four use-after-free defects and an ANGLE memory corruption issue.
• Prompt deployment matters even though Google reported no known exploitation.
• Verify that endpoints have installed and restarted into the patched build; release availability alone is insufficient.
• Google disclosed $31,000 in rewards but had not set bounties for 39 vulnerabilities.
• Monitor exploitation status and fleet coverage separately from bounty amounts.