Chrome 157 is now the stable version of Google’s browser, and the update includes 213 security fixes. Google promoted Chrome 157 to the stable channel for Windows, Mac and Linux on Tuesday, November 3, 2026, according to the Chrome Releases blog. The rollout runs “over the coming days/weeks”, so not every computer gets it on the first day.

The version numbers are 157.0.8103.38 for Linux and 157.0.8103.38/.39 for Windows and Mac. On Android, Chrome 157 (157.0.8103.38) started rolling out through Google Play the same day, with the same security fixes as the desktop release.

Seven critical fixes

Google rates seven of the fixes Critical. All seven are memory-safety bugs, and four sit in the code Chrome uses for graphics:

  • CVE-2026-121156: buffer overflow in Dawn, Chrome’s WebGPU implementation. Reported by Zhenpeng Lin of depthfirst, with a $10,000 reward.
  • CVE-2026-121247: a second buffer overflow in Dawn.
  • CVE-2026-121229: memory corruption in ANGLE, the graphics layer that translates WebGL calls. Reward: $1,000.
  • CVE-2026-121246: use-after-free in WebGL.
  • CVE-2026-121203: use-after-free in Geometry.
  • CVE-2026-121035: use-after-free in Prerender, reported by Xinyang Ge of Anthropic, assisted by Claude.
  • CVE-2026-121126: use-after-free in Core.

The release post does not say that any of these bugs has been exploited in attacks. That makes Chrome 157 a routine, if very large, security release rather than an emergency zero-day patch. For the difference, see our explainer on what a zero-day vulnerability is.

A lot of the credits in the list go to AI-assisted research. Many entries name Xinyang Ge or Vlad Stolyarov of Anthropic, “assisted by Claude”, and others credit OpenAI Codex Security.

New features for web developers

Google’s Chrome 157 release notes list the platform changes. The ones most likely to show up on sites:

  • CORS is now enforced for Background Fetch.
  • CSS gets a corner shorthand, text-decoration-inset, a string value for text-overflow, and anchor-valid and anchor-visible for anchor positioning.
  • HTML gets new insertion and streaming methods, and Capability Elements get an icon-only mode.
  • Service workers can use ProgressEvent, and the Language Detector API reaches Android.
  • Web Bluetooth GATT objects become EventTargets, WebGPU adds atomic-vec2u-min-max, and Long Animation Frames timing gains styleDuration.
  • HTML-in-canvas ships, and origin trials start for Connection Allowlists embedded enforcement and Overscroll Areas.

Most people won’t see any of this directly. Sites start using it when developers adopt it.

How to update

Chrome updates itself, but the new version only takes effect after a restart. To check, open the menu with three dots, go to Help and then About Google Chrome. Chrome looks for the update, downloads it and shows a Relaunch button. The About page should then show version 157.0.8103.38 or later. On Android, update Chrome from Google Play.