Chrome 157: What the Security Update Actually Fixes

On 3 November, Google released Chrome 157 to the stable channel for Windows, Mac and Linux, taking the browser to version 157.0.8103.38 or .39 depending on your system. Chrome for Android was updated too, and will reach Google Play over the coming days. The update bundles 213 security fixes, seven of them rated Critical by Google.

That sounds like a lot, and it is. Chrome is a large piece of software with a huge attack surface, so updates of this size are routine rather than exceptional. There is no suggestion that any of these flaws were being used against anyone before the fix went out. This is Google finding and closing problems, not a breach.

Three of the critical issues are worth naming, because they show what kind of problems these updates close:

• CVE-2026-121229: a memory corruption bug in ANGLE, the graphics component, affecting Chrome for Android. In theory, a specially crafted web page could use this to run code outside Chrome's normal sandbox.
• CVE-2026-121035: a use-after-free bug in Chrome's Prerender feature, which loads pages in the background before you click them.
• CVE-2026-121156: a buffer overflow in Dawn, the component behind WebGPU, which handles advanced graphics in the browser.

The other 210 fixes are not broken down in detail in Google's release, so we won't speculate on what they cover.

What this actually means for you

If your Chrome updates automatically, which is the default on most devices, you may already be protected without having done anything. The update closes doors that a malicious web page could otherwise use. Nothing in Google's release says any accounts, passwords or personal data were accessed. This is a maintenance update, albeit a substantial one.

What to do

1. Open Chrome's menu, go to Help, then About Google Chrome. Chrome checks for updates automatically when you open this screen. If one is pending, click Relaunch to apply it. The update only takes effect after you restart the browser, so if you've left Chrome running for days without closing it, do that now. 2. On Android, check Google Play over the coming days for the Chrome update if it hasn't appeared yet. Rollouts to mobile app stores don't land for everyone on the same day. 3. Make restarting your browser a habit. Updates can download in the background and sit there unapplied until you relaunch. A browser you never close is a browser that may be running old, unpatched code without you realising. 4. Repeat this for other Chromium-based browsers you use, such as Edge or Brave, since they often receive similar fixes on their own schedules. This fact sheet covers Chrome specifically, so check each browser you use.

None of this requires technical knowledge. It is three clicks: menu, About Google Chrome, Relaunch.

What this does not fix

A browser update closes holes in the browser itself. It does not do several things people sometimes assume it does:

• It does not stop you entering a password into a fake website that looks real. That's a phishing problem, not a browser bug.
• It does not check whether a link someone sent you is safe before you click it. Chrome will warn you about some known bad sites, but new scam pages often aren't flagged yet.
• It does not tell you if a password you already use has appeared in a past data breach.
• It does not hide your browsing from your internet provider or from the websites you visit. That's what a VPN is for, and it's a separate job to keeping your browser patched.

Keeping Chrome updated is good hygiene. It is not the same as checking a suspicious message, verifying a link, or knowing whether your passwords are still safe. Those are separate checks worth doing in their own right.