Chrome 157 Fixes 213 Security Issues, Including Seven Critical Vulnerabilities
Summary
Google released Chrome 157 for desktop and Android with 213 security fixes, including seven vulnerabilities it rates Critical. The article details flaws in ANGLE, Prerender and Dawn, and explains how to update.
Key points
- Chrome 157 is rolling out to Windows, Mac and Linux; the Android update is being distributed through Google Play.
- Google says the release includes 213 security fixes, including seven vulnerabilities rated Critical.
- CVE-2026-121229 is a memory corruption flaw in ANGLE affecting Chrome for Android; a crafted HTML page could potentially enable remote code execution outside the sandbox.
- CVE-2026-121035 is a use-after-free in Chrome’s Prerender component.
- CVE-2026-121156 is a buffer overflow in Dawn, which powers WebGPU in Chrome.
- Users can check for and install updates through About Google Chrome in the browser’s settings or Help menu.
Article Details
- Vulnerability Types
- Memory corruption
- Use-after-free
- Buffer overflow
- Severity
- Google rates seven vulnerabilities in the update Critical; individual ratings for the vulnerabilities discussed are not specified.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Update Chrome to version 157.0.8103.38/.39 for Windows and Mac, or 157.0.8103.38 for Linux and Android.
MITRE ATT&CK
CVE
CVE-2026-121035Google · ChromeCVE-2026-121035: Use-after-free in Prerender.CVE-2026-121156Google · ChromeCVE-2026-121156: Buffer overflow in Dawn.CVE-2026-121229Google · ChromeCVE-2026-121229: Memory corruption in ANGLE, which could allow a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.