Quick Answer
Chrome 157 is a security update that fixes 213 desktop issues, including seven rated Critical, so Windows, Mac, and Linux users should install it as soon as it appears. Google released Stable builds on November 3, 2026, with rollout occurring over days and weeks. Open Chrome’s About page, allow the download, and relaunch the browser to finish installation.
Key Takeaways
- Chrome 157 includes 213 desktop security fixes.
- Seven Chrome 157 vulnerabilities carry a Critical severity rating.
- Critical fixes include flaws in Dawn, ANGLE, WebGL, Prerender, Geometry, and Core.
- Google has not said that any newly fixed Chrome 157 flaw was exploited in the wild.
- Chrome users can install the update through Help > About Google Chrome.
What does the Chrome 157 security update fix?
Chrome 157 fixes 213 security issues on desktop browsers, including seven vulnerabilities Google rated Critical. Google promoted Chrome 157 to the Stable channel for Windows, macOS, and Linux on November 3, 2026, although the company says the rollout will reach users over the following days and weeks. Google’s Chrome release advisory lists version 157.0.8103.38 for Linux and version 157.0.8103.38/.39 for Windows and macOS.
The Chrome 157 security update matters because a browser handles web pages, downloaded files, graphics content, account sessions, and other data that users access every day. A security correction can reduce exposure to a known software flaw, but the correction only protects a device after the updated browser version is installed and relaunched.
Chrome normally checks for updates automatically, but an automatic update does not always complete while the browser remains open. The practical response is to verify the installed version rather than assuming an update has already finished. Users who recently reviewed Chrome extension security risks should treat browser updates and extension reviews as separate protections, because updating Chrome does not remove an unwanted extension.
Which Chrome 157 flaws are rated Critical?
Chrome 157 includes seven Critical fixes, with publicly identified examples involving memory-safety problems in graphics and browser components. Google lists CVE-2026-121156 as a buffer overflow in Dawn and CVE-2026-121229 as memory corruption in ANGLE. Google also identifies Critical use-after-free issues in WebGL, Prerender, Geometry, and Core, plus another buffer overflow in Dawn.
Memory-safety flaws matter because a browser component can handle data in an unexpected way when a defect is present. The public advisory does not provide enough detail for users to determine whether a particular website or file could trigger a specific issue. The sensible action is therefore to install the patched version instead of trying to assess exposure from the vulnerability names alone.
| Chrome 157 security issue | Component | Google’s listed issue type | What users should do |
|---|---|---|---|
| CVE-2026-121156 | Dawn | Buffer overflow | Install Chrome 157 and relaunch Chrome. |
| CVE-2026-121229 | ANGLE | Memory corruption | Install Chrome 157 and relaunch Chrome. |
| Other Critical fixes | WebGL, Prerender, Geometry, Core, and Dawn | Use-after-free and buffer overflow issues | Confirm that Chrome shows version 157 after updating. |
Google awarded $10,000 for the Dawn report associated with CVE-2026-121156 and $1,000 for the ANGLE report associated with CVE-2026-121229. Those rewards indicate that outside researchers reported the flaws through Google’s vulnerability process, but a reward amount does not tell an ordinary user how likely a specific device was to be targeted.
Has Chrome 157 been linked to attacks in the wild?
Chrome 157 has not been identified by Google as fixing a vulnerability exploited in the wild. Independent coverage published November 4 states that Google did not say any of the newly fixed flaws had been used in active attacks. SecurityWeek’s coverage of the update also confirms the 213-fix total and the seven Critical ratings.
The absence of a disclosed active-exploitation statement is useful context, but it is not a reason to postpone the update. Security advisories can provide limited technical detail while a fix is rolling out, and public knowledge of a flaw can increase after an update makes clear that a vulnerable component exists.
Chrome users should avoid treating a Critical rating as proof that their computer has been compromised. A severity rating describes the potential seriousness of a vulnerability, not a diagnosis of a particular device. The practical action is to update Chrome, keep account credentials private, and investigate only if there are separate signs of account misuse or suspicious browser behavior.
How do you install the Chrome 157 security update?
To install the Chrome 157 security update, open Chrome’s three-dot menu, select Help, choose About Google Chrome, and relaunch the browser after the download completes. Chrome checks for the available release from that page and displays the installed version when the process is complete. PCWorld’s update guide describes the same desktop update path.
- Open Google Chrome on a Windows, Mac, or Linux computer.
- Select the three-dot menu in the upper-right corner.
- Select Help, then choose About Google Chrome.
- Wait while Chrome checks for and downloads the available update.
- Select Relaunch when Chrome offers the option.
- Return to the About Google Chrome page and confirm that Chrome shows version 157.
Chrome 157 is rolling out gradually, so the update may not appear on every device at the same moment. Wait for Chrome to offer the Stable release if the About page does not yet show version 157. Do not download browser installers from an unfamiliar pop-up, email attachment, or third-party update page, because legitimate Chrome updates are available through Chrome itself or Google’s official distribution channels.
Why should Chrome users relaunch after the download finishes?
Chrome 157 requires a relaunch to complete the installed update because the browser must close its active session and start the updated program files. A downloaded update without a relaunch can leave the previous browser process running, which means the security corrections are not fully active yet.
Chrome users can save open work before selecting Relaunch, especially when they have unsaved form entries, unfinished uploads, or web-based documents open in tabs. Chrome commonly restores tabs after restarting, but restoring tabs does not guarantee that every website preserves unfinished work. The practical response is to save important work first, then relaunch Chrome rather than leaving an update pending for days.
Browser updates also protect only the browser version that receives them. A user who has Chrome installed on multiple computers should check each device separately. The same principle applies to browser-based services such as web messaging sessions, where a secure browser update is useful but does not replace account-level safeguards such as reviewing active sessions.
What should Chrome users do after updating to version 157?
Chrome users should confirm the version number, review unfamiliar extensions, and resume normal browsing after Chrome 157 is installed. The key confirmation is that the About Google Chrome page reports version 157 rather than only showing that an update downloaded. This matters because the relaunch step activates the new browser build.
Chrome 157 does not require users to reset passwords, clear all browsing data, or reinstall the browser solely because the update contains Critical fixes. Those actions may be appropriate after a separate account-security incident, but the available Chrome 157 information does not establish that a normal user has been compromised.
Users who notice unexpected searches, altered home pages, new toolbars, or repeated redirects should check installed extensions and account settings separately. A browser update corrects browser code, while unwanted extensions can change browsing behavior through their own permissions. The most sensible approach is to remove extensions that are unrecognized or no longer needed, then keep Chrome updated.
When will the Chrome 157 update reach every device?
Chrome 157 will reach desktop users over days and weeks following the November 3, 2026 Stable-channel promotion. Google’s staged rollout means that two computers can receive the same security update at different times, even when both use Chrome on supported desktop operating systems.
Chrome users can check availability manually through Help > About Google Chrome instead of waiting for a browser notification. The About page is the appropriate place to verify whether a device has received Chrome 157, because it checks the browser’s update service and displays the version installed on that computer.
Chrome for Android received version 157.0.8103.46 on November 5, 2026, and Google says Android releases contain corresponding desktop security fixes unless otherwise noted. Android users should use the Play Store or their device’s normal app-update controls rather than attempting to install a browser package from an unknown source. Stop and contact device support if an update repeatedly fails or Chrome cannot open after a restart.
What should organizations do about the Chrome 157 security update?
Organizations should prioritize deployment of Chrome 157 on managed Windows, macOS, and Linux devices because the release includes 213 fixes and seven Critical vulnerabilities. A managed browser environment can verify installed versions across company devices, which is more reliable than asking every employee to remember a manual update.
Security teams should communicate one clear action: employees should relaunch Chrome when the update is available, then report update failures through the organization’s usual support channel. Employees should not attempt registry edits, operating-system repairs, or unapproved browser downloads if a managed update does not install. Those changes can create separate device-management and security problems.
Organizations should also distinguish the Chrome 157 update from account or extension incidents. Browser patching reduces risk from corrected Chrome flaws, while compromised credentials, malicious extensions, and suspicious login activity require their own investigation and response process. The appropriate stop line is the internal IT or security team when a device shows signs beyond a normal update prompt.
FAQ
Does Chrome 157 fix Critical security vulnerabilities?
Yes, Chrome 157 fixes seven vulnerabilities Google rated Critical. The listed issues include buffer overflow, memory corruption, and use-after-free flaws in several Chrome components.
How many security bugs does Chrome 157 fix?
Chrome 157 fixes 213 security issues on desktop versions for Windows, macOS, and Linux. Google promoted the desktop release to the Stable channel on November 3, 2026.
Do I need to restart Chrome after updating?
Yes, Chrome needs a relaunch to complete the Chrome 157 installation. Save unfinished work before restarting because some websites may not preserve unsaved entries.
Has Chrome 157 fixed an actively exploited vulnerability?
No active exploitation was identified in the available Chrome 157 release information. Google did not say that any of the newly fixed vulnerabilities had been exploited in the wild.
How do I check whether Chrome 157 is installed?
Chrome users can check the installed version through the three-dot menu, Help, and About Google Chrome. The About page should show version 157 after the update downloads and Chrome relaunches.