Chrome 157 Update: 7 Critical Fixes and How to Install It
Google released Chrome 157 to the stable channel on November 3, 2026, with 213 security fixes, seven of them rated Critical. The desktop versions are 157.0.8103.38/.39 for Windows and Mac and 157.0.8103.38 for Linux; Android gets 157.0.8103.38 through Google Play over the next few days. To install it now on a computer, go to More (⋮) > Help > About Google Chrome and select Relaunch.
This guide lists the Critical bugs, explains what they mean in plain terms, and shows how to confirm you’re on 157 on each platform.
Before you start
- Applies to: Chrome on Windows, Mac, Linux and Android
- Target version: 157.0.8103.38 or later (Windows and Mac may show .39)
- Time: about 2 minutes, plus a browser restart
- Exploited in the wild? Google’s release notes don’t say any of these bugs are being exploited (checked November 4, 2026)
What Google fixed in Chrome 157
Google’s desktop release notes list 213 security fixes. Counting the entries in the notes gives 7 Critical, 77 High, 75 Medium and 54 Low. As usual, Google keeps bug details restricted until most users have updated, so only one-line descriptions are public.
| CVE | Component | Bug type |
|---|---|---|
| CVE-2026-121156 | Dawn | Buffer overflow |
| CVE-2026-121229 | ANGLE | Memory corruption |
| CVE-2026-121246 | WebGL | Use after free |
| CVE-2026-121035 | Prerender | Use after free |
| CVE-2026-121247 | Dawn | Buffer overflow |
| CVE-2026-121203 | Geometry | Use after free |
| CVE-2026-121126 | Core | Use after free |
What those components do
- Dawn is Chrome’s implementation of WebGPU, the API that lets web pages use your graphics card. Two of the seven Critical bugs are here.
- ANGLE translates web graphics calls into the graphics system your operating system uses (Direct3D, Metal, Vulkan or OpenGL).
- WebGL is the older 3D graphics API for web pages.
- Prerender loads pages in the background before you click, so they open instantly.
“Use after free” means the browser keeps using a chunk of memory after releasing it; “buffer overflow” means it writes past the end of one. Both can let a booby-trapped web page run code. Critical is the top rating in Chromium’s severity guidelines, used for bugs that could let an attacker run code on your device during normal browsing.
Is anyone exploiting these bugs?
Google’s notes for Chrome 157 don’t mark any fix as exploited in the wild. When a fix covers an exploited bug, Google states it in the release post. The absence of that line is good news, but once a patch is public, attackers can compare old and new code to find the flaw, so the gap between release and your update matters.
How to update Chrome on Windows, Mac and Linux
- Open Chrome.
- Select More (⋮) at the top right, then Help > About Google Chrome. You can also type
chrome://settings/helpin the address bar. - Chrome checks for the update and downloads it.
- Select Relaunch. If there’s no Relaunch button, you’re already on the latest version.
- Check the version line reads 157.0.8103.38 or higher.
Google’s update help page notes that Chrome reopens your tabs and windows after relaunching, but Incognito windows don’t come back. Finish anything in Incognito first.
How to update Chrome on Android
- Open the Google Play Store.
- Tap your profile picture, then Manage apps & device.
- Under Updates available, find Chrome and tap Update.
- To confirm, open Chrome and go to ⋮ > Settings > About Chrome.
Google’s Android release note says the update reaches Google Play “over the next few days,” so it may not show up yet. Check again tomorrow if it doesn’t.
What about Chrome on iPhone and iPad?
We couldn’t find a Chrome 157 security note for iOS on the Chrome Releases blog when we checked. Chrome on iPhone uses Apple’s WebKit engine, not the Blink engine these bugs live in, so desktop and Android bugs don’t map directly to it. Updating through the App Store is still a good habit.
If Chrome won’t update
- “Managed by your organization”: your employer controls updates. Ask IT when 157 will be pushed.
- Update stuck or failed: close every Chrome window (on Windows, check the system tray for a Chrome icon), reopen it and try again. Restarting the computer clears most stuck updates.
- Old operating system: Chrome stops updating on systems Google no longer supports. If the version won’t move, check Chrome’s system requirements.
Edge, Brave, Opera and Vivaldi are built on Chromium and usually ship their own versions with these fixes on their own schedules. Update each one separately from its About page.
Frequently asked questions
Does Chrome update automatically?
Yes, it downloads updates in the background, but the update only applies when you close and reopen the browser. If you leave Chrome open for days, you can be running an old version. Relaunching is what finishes the job.
Will I lose my tabs?
No. Chrome restores normal tabs and windows after a relaunch. Incognito windows are closed for good.
Is there anything new to see in Chrome 157?
Google’s release note covers fixes only and says separate posts about new features are coming. We’ll cover any user-facing changes once Google documents them.
What to do next
Relaunch Chrome now and check the version number, then do the same for any other Chromium browsers you use. While you’re in settings, two quick hardening steps are worth a look: Chrome’s ClickFix protection against fake “verify you’re human” commands, and turning off Enhanced Autofill’s Gmail access if you don’t want Chrome reading your inbox for form data.
How we checked: version numbers, CVE IDs and severity counts come from Google’s Chrome Releases posts dated November 3, 2026, read on November 4. Update steps follow Google’s Chrome Help pages.
