Chrome 157 Security Update: 213 Fixes, Seven Rated Critical, and How to Check Every Device Is Patched

Google released Chrome 157 on Tuesday, November 3, 2026, and its release notes list 213 security fixes, seven of them rated Critical. If your staff use Chrome for email, banking, payroll or cloud apps, every computer should be on version 157.0.8103.38 or later this week, and the fix only works once the browser restarts.

Google has not said that attackers are using any of these flaws. So this is a large, routine update and not an emergency. The right move is to roll it out on schedule and then confirm it actually landed.

What Google confirmed in the Chrome 157 release

Google's Chrome Releases post, "Stable Channel Update for Desktop," dated November 3, 2026, announces Chrome 157 on the stable channel for Windows, Mac and Linux. The post says plainly: "This update includes 213 security fixes." Google also says the update "will roll out over the coming days/weeks," so not every device gets it on day one.

We counted the security list Google published: 7 Critical, 77 High, 75 Medium and 54 Low, which matches Google's stated total of 213. Google says the Android build "will become available on Google Play over the next few days."

The seven critical Chrome 157 vulnerabilities

Google gives each Critical fix a single line:

• CVE-2026-121156: Buffer overflow in Dawn
• CVE-2026-121247: Buffer overflow in Dawn
• CVE-2026-121229: Memory corruption in ANGLE
• CVE-2026-121246: Use after free in WebGL
• CVE-2026-121035: Use after free in Prerender
• CVE-2026-121203: Use after free in Geometry
• CVE-2026-121126: Use after free in Core

In plain terms: Dawn, ANGLE and WebGL are graphics parts of Chrome that turn web page instructions into work for your computer's graphics hardware. Prerender loads pages ahead of time so they open faster. Google does not describe the "Core" or "Geometry" components any further. "Use after free" and "buffer overflow" are memory-safety bugs. In general, this is the type of bug a booby-trapped web page can try to turn into running code on a computer. Google credits outside researchers with some of these fixes and lists a $10,000 bounty for one of the Dawn buffer overflows.

What is not known about Chrome 157 yet

• Exploitation. Google's post does not say any of these flaws are being exploited in the wild. We found no such statement in the post.
• Technical details. Google says "access to bug details and links may be kept restricted until a majority of users are updated with a fix." That is on purpose, and it means nobody outside Google can say yet how hard these bugs are to attack.
• Other Chromium browsers. Microsoft Edge, Brave, Opera and Vivaldi are built on the same Chromium code, but each vendor ships on its own schedule. We have not confirmed which of them have shipped these fixes, so check each vendor's own release notes.

How to check your Chrome version

On Windows, Mac or Linux:

1. Open Chrome, click the three-dot menu, then go to Help and then About Google Chrome. You can also type chrome://settings/help in the address bar.
2. Chrome checks for the update and downloads it.
3. Click Relaunch. Your tabs reopen afterwards.
4. Confirm the version shows 157.0.8103.38 or higher.

On Android, open Google Play, search for Chrome and tap Update, then confirm the version in Chrome under Settings and then About Chrome.

If a Windows computer shows Chrome 158, that is fine. On November 4, Google began an early stable release of 158.0.8127.18/.19 to a limited share of Windows users, with Mac "coming shortly." A higher version is newer than 157.

How to roll out Chrome 157 across a company

If you manage Chrome through Google Admin console, Group Policy or a device management tool, two Chrome Enterprise policies matter here:

• RelaunchNotification: Google describes it as a way to "notify a user that a browser relaunch or device restart is recommended or required."
• RelaunchNotificationPeriod: Google describes it as "set the time period for update notifications."

Together, they let IT decide whether a restart is a suggestion or a requirement, and how long staff have before it happens. Without them, a laptop can download Chrome 157 and still run the old, unpatched version for days, because people rarely close their browser. That gap is the subject of our post Updated Is Not the Same as Patched.

Also look for the usual blockers: update policies that pin an old version, computers that have been off the network, and machines on operating systems Chrome no longer supports.

Why Chrome 157 matters for a business network

The browser is now where most company work happens: email, accounting, CRM, payroll, and the admin panels for your website and hosting. One computer running an old Chrome while logged in to Microsoft 365 or your website's control panel is a direct way into those accounts. Browser fixes also stack up: Chrome 157 lands only a few weeks after the release we covered in Chrome 156 and Firefox 159 Security Updates.

While you are checking versions, review installed extensions too. An up-to-date browser with a bad extension is still exposed, as covered in Malicious Chrome Extensions.

Chrome 157 security update checklist for this week

Chrome 157 security update questions people are asking

Is Chrome 157 safe to install?

Yes. It is Google's official stable release, and it fixes 213 security issues. Install it through Chrome's own updater or from Google's official Chrome site, never from a download link in an email or ad.

What is the latest Chrome version?

For most users it is 157.0.8103.38 (Linux, Android) or 157.0.8103.38/.39 (Windows, Mac). Some Windows users are getting the early Chrome 158 build, 158.0.8127.18/.19.

Are any Chrome 157 vulnerabilities being exploited?

Google's release post does not say any of them are being exploited. That could change, so watch for a follow-up Chrome update.

Do I need to restart Chrome after updating?

Yes. The fixes only apply after Chrome relaunches. Until then, the old version is still running.

Does the Chrome 157 update cover iPhone and iPad?

Google's desktop post covers Windows, Mac and Linux, and a separate post covers Android. For iPhone and iPad, update Chrome through the App Store.

Does this fix Microsoft Edge?

Not directly. Edge uses the same Chromium base, but Microsoft releases its own updates. Check Edge under Settings and then About Microsoft Edge.

The bigger lesson

Browser security updates now arrive every few weeks, and each one only protects you once it is installed and the browser has restarted on every device. The businesses that handle this well have not found some special tool. They have a policy that forces the restart and a report that shows who is behind.

Want help locking this down? See security hardening or request a tech quote.

Get security alerts like this by email, plus our free checklist, at /security-alerts.

Sources: Google Chrome Releases: Stable Channel Update for Desktop, November 3, 2026; Google Chrome Releases feed (full post text, Chrome for Android and Early Stable posts); Chrome Enterprise policy: RelaunchNotification; Chrome Enterprise policy: RelaunchNotificationPeriod.