Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical

The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.

By

Ionut Arghire

| November 4, 2026 (6:38 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Google has promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities, including seven critical memory safety bugs.

At the top of the list is a buffer overflow issue in Dawn, the open source and cross-platform implementation of the WebGPU standard. It earned the reporting researcher a $10,000 reward.

The second is a memory corruption in the open source graphics engine abstraction layer ANGLE that was awarded a $1,000 bug bounty.

No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.

Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.

Per Google’s advisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.

Advertisement. Scroll to continue reading.

The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).

Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.

The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.

Related:Android’s November 2026 Updates Patch Over 200 Vulnerabilities

Related:Critical Node-RED Flaw Exploited in Attacks

Related:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million

Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Google Dismantles XCPE Botnet of 1.3 Million Android Devices
  • Revolve Data Breach Impacts at Least 200,000 People
  • Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
  • Malicious Claude Code Extension Served in Cursor Supply Chain Attack
  • Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
  • PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  • Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
  • Fresh WordPress Vulnerability in Attackers’ Crosshairs

Latest News

  • Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist
  • North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on Binance Hack
  • Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
  • Frontline Education Data Breach Impacts Over 1.3 Million
  • CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode
  • Android’s November 2026 Updates Patch Over 200 Vulnerabilities
  • Critical Node-RED Flaw Exploited in Attacks
  • UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028

Trending

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode

enSilo Raises $23 Million in Series B Funding

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

Revolve Data Breach Impacts at Least 200,000 People

Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Cybersecurity M&A Roundup: 37 Deals Announced in October 2026

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Passkeys Are Better Than Passwords. But They Are Not Enough.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)