Google put Chrome 157 on the stable channel on November 3. Per Malwarebytes, desktop lands at 157.0.8103.38/.39 for Windows and Mac and 157.0.8103.38 for Linux, Android is also at 157.0.8103.38, and the whole thing carries 213 security fixes. Seven are rated Critical by Google. The rollout takes “days and weeks”, so your browser may not have it yet.
Two hundred and thirteen. That’s not a patch, that’s a census.
The one with a CVE and a score worth reading is CVE-2026-121229. NVD: memory corruption in ANGLE in Chrome on Android prior to 157.0.8103.38, allowing a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium severity Critical. The secondary CVSS 3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C), scope changed, because getting out of the sandbox is the whole point. User interaction required, which in browser terms means “load the page.”
ANGLE is Chrome’s graphics translation layer. It takes GL calls and turns them into whatever the platform’s driver wants. That means a pile of C++ parsing untrusted input from any web page, sitting right next to a GPU driver. I have opinions about that architecture, and they’re the same opinions I had in 2012.
Malwarebytes also names two more from the Critical set:
- CVE-2026-121035: use-after-free in Prerender, the component that loads and renders a page, JavaScript included, before you click the link.
- CVE-2026-121156: buffer overflow in Dawn, which implements WebGPU.
Use-after-free and buffer overflow. In 2026. We have been writing about this class of bug since the Morris worm, and the memory-safety argument has not gotten less boring for being correct. The bundle I read doesn’t say any of these are exploited in the wild, so I won’t claim it. The advisory title and date are the only thing the Chrome Releases page gave me, so the CVE list above is the Malwarebytes and NVD subset, not the full 213.
What to do:
- Open About Google Chrome from the menu. It checks, downloads, and asks you to Relaunch. Click it.
- If you never close the browser, you are the person who lags behind. Close it. A pending update does nothing for the tab you’ve had open since last Thursday.
- Android users: the update comes through Google Play over the coming days. Check the version string against 157.0.8103.38.
- Chromium-derived browsers inherit this stuff on their own schedule. I’m not going to guess what they’ve shipped.
I’ll admit the part I’d rather not. Chrome’s sandbox is a serious piece of engineering, and a bug that escapes it is rated Critical because the model mostly holds. If you want the mechanics of what a process sandbox actually leans on, the Linux sandboxing hub covers seccomp and namespaces, and the kernel and security hub tracks the CVEs that matter. Meanwhile, close the browser.