Chrome 157 Addresses 213 Security Flaws, Including 7 Critical Vulnerabilities
What Happened — On 3 November 2026 Google released Chrome 157 (stable channel) for Windows, macOS, Linux and Android. The update patches 213 security issues, seven of which Google rates as Critical. Notable CVEs include CVE‑2026‑121229 (memory‑corruption in the ANGLE graphics layer that can break the sandbox), CVE‑2026‑121035 (use‑after‑free in Prerender), and CVE‑2026‑121156 (buffer overflow in Dawn/WebGPU). Exploitation could let a remote attacker execute arbitrary code on the host operating system simply by delivering a crafted web page. The update rolls out automatically, but users who keep the browser open or run restrictive extensions may lag behind.
Why It Matters for Trust & Control Assurance — The presence of remote‑code‑execution flaws underscores the importance of a disciplined patch‑management control that provides continuous evidence of timely remediation across the organization.
Who Is Affected — Enterprises and end‑users across all sectors that rely on Chrome as a primary web browser, especially those in technology, finance, healthcare, and education.
Recommended Actions –
- Verify that Chrome 157 is deployed on all endpoints; use centralized software‑distribution tools to force updates where needed.
- Map the patch‑management activity to your control‑objective for vulnerability remediation and capture evidence (e.g., update logs, inventory snapshots) for audit readiness.
- Review any extensions or policies that might block automatic updates and remediate them.
Technical Notes –
- CVE‑2026‑121229 – Memory‑corruption in ANGLE, remote code execution outside the sandbox via a crafted HTML page.
- CVE‑2026‑121035 – Use‑after‑free in Prerender, possible code execution when a pre‑rendered page is visited.
- CVE‑2026‑121156 – Buffer overflow in Dawn (WebGPU), enabling arbitrary code execution.
- Attack vector: exploitation of browser‑rendering components through malicious web content. Source: Malwarebytes Labs