.jpg?w=1024)
Google has patched 213 security vulnerabilities in Chrome 157, including seven critical flaws affecting browser components responsible for graphics rendering, memory handling, and other functions.
The update, released Nov. 3 for Windows, macOS, and Linux, addresses 77 high-severity vulnerabilities alongside the critical issues. Google is distributing the fixes gradually, and users may need to restart their browsers to complete installation.
Although Google has not disclosed evidence of active exploitation, the number and severity of the vulnerabilities make Chrome 157 an important update for individual users and enterprise security teams.
Seven critical flaws affect browser security
The critical vulnerabilities affect several Chrome components, including Dawn, ANGLE, WebGL, Prerender, Geometry and Core.
Two involve buffer overflows in Dawn, which powers Chrome's implementation of WebGPU. One of them, CVE-2026-121156, was reported by Zhenpeng (Leo) Lin of depthfirst and earned a $10,000 bug bounty. Another critical flaw, CVE-2026-121229, involves memory corruption in ANGLE, Chrome's graphics translation layer. Researcher @mfx reported the issue and received a $1,000 reward.
The remaining five critical vulnerabilities include four use-after-free issues and another buffer overflow. These memory-safety flaws can cause crashes and, depending on the affected component and exploit conditions, may allow attackers to execute malicious code.
The update also fixes 77 high-severity vulnerabilities, including authorization weaknesses, memory corruption and type-confusion issues affecting components such as V8, PDFium and ANGLE. Google says it has awarded researchers $31,000 in bug bounties so far, although rewards for 39 reported flaws remain undetermined.
AI-assisted security research gains attention
Another notable aspect of the release is the growing role of AI tools in vulnerability discovery. Google's advisory credits Anthropic researcher Xinyang Ge with several findings assisted by Claude, including flaws in Prerender, Geometry and other Chrome components.
OpenAI Codex Security also appears among the credited reporters for multiple vulnerabilities, including issues affecting V8 and PDFium.
The credits highlight the growing visibility of AI-assisted vulnerability research, although they do not establish that AI systems independently discovered or validated the flaws. For browser developers, these tools could expand the volume of reported vulnerabilities, increasing the need to investigate findings, prioritize fixes, and deliver patches before attackers exploit them.
What Chrome users should do now
Chrome users should install version 157 rather than wait indefinitely for the automatic rollout. Google has not disclosed active exploitation of the patched vulnerabilities, but the number of critical and high-severity flaws makes delaying the update an unnecessary security risk.
To check for the update, open Chrome's three-dot menu, navigate to Help > About Google Chrome and allow the browser to check for a newer version. If the update is available, select Relaunch to complete the installation.
Chrome for Android is also receiving version 157.0.8103.38 through Google Play, with availability expanding over the coming days.
Enterprises should treat browser updates as security priorities
For businesses, Chrome 157 presents another reminder that browser security deserves a place in routine endpoint management.
For enterprise IT teams, the priority is confirming that Chrome 157 has reached managed endpoints and that employees have restarted their browsers to activate the fixes. Administrators should use their endpoint management tools to identify outdated installations, check update compliance, and investigate devices that have missed the rollout.
IT administrators should verify that managed devices have received the patched version and identify endpoints still running older releases. Employees who leave browsers open for extended periods may also need reminders to restart Chrome and complete the update.
Organizations should pay particular attention to unmanaged devices and systems that do not regularly connect to corporate networks, where update compliance may be harder to monitor.
Google is withholding some technical details until more users receive the fixes, limiting the information available about potential exploitation paths. For security teams, that makes timely deployment and verification especially important, even without reports of active attacks.
In other news, Google's November 2026 Android security update addresses 216 vulnerabilities, including a critical flaw that could allow remote code execution without user interaction, prompting users and businesses to check their devices' security patch levels.