Dawn buffer overflow
Google rates this Critical. A malicious HTML page can trigger potential code execution outside the sandbox in Chrome before 157.0.8103.38.
Chrome 157 fixes 213 security bugs, including seven critical flaws
Chrome 157 fixes 213 security bugs, including seven critical flaws. Crafted web pages can trigger code execution; three critical entries are Android-specific. Update desktop/Android Stable and restart. Extended Stable 156.0.8078.88 carries a separate 55-fix update, not all 213 fixes. Exploitation is unconfirmed.
- Disclosed
- Nov 3, 2026
- Public disclosure date
- Severity
- Sharted
- 9 CVEs tracked here
- Splash zone
- Chrome desktop and Android users visiting attacker-controlled HTML; some critical bugs are Android-specific
- chromium · android
- In the wild
- Unknown
- Google’s release notes do not report exploitation; this is not proof that none occurred.
What happened
Google’s November 3 Chrome 157 release fixes 213 security issues in one batch. The CVE entries here highlight all seven Critical issues in that release and the two additional Critical issues in the accompanying Extended Stable update; they are not the full 213-entry list. The complete vendor list remains in the desktop release and readable public feed. These are vendor severity labels, not independently assigned CVSS scores.
The seven Chrome 157 Critical issues are not interchangeable: Google’s CNA records limit the ANGLE, WebGL and second Dawn entry to Android. The Geometry issue describes code execution inside the sandbox; the other six describe execution, or potential execution, outside it. The attack input is a crafted HTML page. The release and CNA descriptions do not specify additional feature/configuration prerequisites; restricted bug details cannot support invented exploit chains. No public PoC or confirmed exploitation is established by the reviewed sources. L3 reflects a mainstream browser and vendor-described sandbox-boundary risks, rather than a claim of an ongoing attack campaign.
Desktop Stable fixes ship as 157.0.8103.38/.39 on Windows/Mac and 157.0.8103.38 on Linux. Android receives 157.0.8103.38 and the corresponding desktop fixes unless otherwise noted. Rollout takes days or weeks on desktop and days in Play; installation and browser restart must be verified.
Windows/Mac Extended Stable separately receives 156.0.8078.88 with 55 security fixes. That list includes CVE-2026-121156, plus earlier disclosures CVE-2026-118306 and CVE-2026-76024. Their earlier Stable fix thresholds were 156.0.8078.73 and 156.0.8078.79 respectively; this report does not change their initial disclosure dates to November 3. The 55 and 213 lists overlap: do not add them as unique vulnerabilities, or treat 156.0.8078.88 as a universal fix for every Chrome 157 issue. Other products need their own release confirmation.
What’s in the bowl
ANGLE memory corruption on Android
Google rates this Critical. A malicious HTML page can trigger potential code execution outside the sandbox in Android Chrome before 157.0.8103.38.
WebGL use-after-free on Android
Google rates this Critical. A malicious HTML page can trigger potential code execution outside the sandbox in Android Chrome before 157.0.8103.38.
Prerender use-after-free
Google rates this Critical. A malicious HTML page can trigger code execution outside the sandbox in Chrome before 157.0.8103.38.
Dawn buffer overflow on Android
Google rates this Critical. A malicious HTML page can trigger potential code execution outside the sandbox in Android Chrome before 157.0.8103.38.
Geometry use-after-free
Google rates this Critical. A malicious HTML page can trigger code execution inside the sandbox in Chrome before 157.0.8103.38.
Core use-after-free
Google rates this Critical. A malicious HTML page can trigger potential code execution outside the sandbox in Chrome before 157.0.8103.38.
FileSystem use-after-free — earlier Stable fix
Google rates this Critical. A malicious HTML page can trigger code execution outside the sandbox in Chrome before 156.0.8078.73.
MediaStream use-after-free — earlier Stable fix
Google rates this Critical. A malicious HTML page can trigger code execution inside the sandbox in Chrome before 156.0.8078.79.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Chrome Stable — Windows / macOS | 157.0.8103.38 | Google ships .38/.39 |
| Chrome Stable — Linux | 157.0.8103.38 | Stable release |
| Chrome Stable — Android | 157.0.8103.38 | Google Play rollout |
| Chrome Extended Stable — Windows / macOS | 156.0.8078.88 | Separate 55-fix update; not all 157 fixes |
Crime-scene timeline
Nov 3, 2026
Extended Stable receives a separate 55-fix update
156.0.8078.88 lists three critical CVEs, including Dawn CVE-2026-121156 and two earlier Stable disclosures.
Nov 3, 2026
Chrome 157 reaches desktop Stable
Google lists 213 security fixes: seven Critical, 77 High, 75 Medium and 54 Low. Windows/Mac receive .38/.39; Linux receives .38.
Nov 3, 2026
Android Stable rollout begins
157.0.8103.38 includes corresponding desktop security fixes unless otherwise noted; Play availability may take days.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Google Chrome 157 desktop releasePrimary213 fixes and seven Critical entries; no exploitation statement.
- Google Chrome 157 Android releasePrimary157.0.8103.38 rollout and corresponding desktop security fixes.
- Google Extended Stable November 3 releasePrimary156.0.8078.88 and its separate 55-CVE list.
- Google Chrome Releases public feedPrimaryReadable full originals when direct HTML omits article bodies; same publisher, not independent corroboration.
- Google desktop update instructionsPrimaryAbout Chrome, restart requirement and Linux package-manager route.
- Google Android update instructionsPrimaryPlay Store update path and version checking.
- Google CNA record CVE-2026-121156PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-121229PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-121246PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-121035PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-121247PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-121203PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-121126PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-118306PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.
- Google CNA record CVE-2026-76024PrimaryVendor-authored record; individual platform, affected version and sandbox boundary.