Chrome 157 reaches stable with 213 security fixes

Google began rolling out Chrome 157 to Windows, macOS, and Linux on November 3. The release bulletin lists 213 security fixes, including several critical issues. To tell whether the patch is active on your computer, check the version the browser is running after you relaunch it.

What Google fixed

Two examples show why a security update matters even when the browser looks the same. CVE-2026-121156 is a buffer overflow in Dawn, a graphics component. A buffer overflow happens when software writes beyond the memory set aside for a buffer. CVE-2026-121246 affects WebGL and is a use-after-free flaw. The browser tries to use memory it already released, which may have been reassigned to another task.

Google also rated a flaw in Prerender (CVE-2026-121035) as critical. Prerender can prepare a page before you open it. The severity helps you prioritize the update. The bulletin alone cannot tell you whether a particular computer was targeted.

How to verify the patch is active

1. On Windows or macOS, open Chrome’s menu and choose Help → About Google Chrome. Opening that screen triggers an update check.
2. If you see Relaunch, save your work and restart the browser. On Linux, Google directs users to update through their package manager.
3. Return to About Google Chrome and check the full build number. The initial bulletin lists 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and Mac. A later stable build can also contain these fixes.

If you manage several computers

Start with a small group that represents your operating systems and business web apps. Check that people can sign in and use essential extensions, then expand the rollout once those checks pass. Track how many computers are running a patched build and how many still need a browser restart. That distinction helps identify computers that downloaded the update but are still running the old browser.

Chrome 157 release bulletin · Google’s update guide