Google released Chrome 157 to the stable channel on November 3 with fixes for 213 security flaws, seven of them rated critical. Google has not said any of the bugs are being exploited in the wild.
Chrome 157.0.8103.38 Brings an Unusually Large Patch Batch
The stable release is version 157.0.8103.38 for Linux and 157.0.8103.38 or .39 for Windows and Mac. Seven of the fixes address critical memory bugs in graphics and rendering code, and 77 more are rated high severity. Google lists 84 critical and high-severity bugs in total, and 38 of those were reported by Google’s own teams.
The size of the batch is unusual. A malicious web page could use the critical bugs to escape the browser’s limits and run code, which is why memory flaws in rendering and graphics components attract close attention. The rollout continues over days to weeks, so some users will not see the update immediately.
Anthropic and OpenAI Tools Credited With Findings
Researchers at Anthropic, assisted by Claude, reported 12 of the listed bugs, including the critical Prerender flaw tracked as CVE-2026-121035. OpenAI Codex Security found five more. Their contributions place AI-assisted vulnerability research among the sources of reports in this release, alongside Google’s internal teams.
Bug Bounty Rewards Top Out at $10,000
The largest rewards in the release were $10,000 each. One went to the Dawn overflow flaw CVE-2026-121156, and the other to a BackgroundFetch authorization bug. Dawn is part of Chrome’s graphics stack, which fits the release’s concentration of critical memory bugs in graphics and rendering code.
Memory Flaws in Graphics and Rendering Code
Memory safety bugs such as overflows are a long-standing source of browser vulnerabilities, because rendering code processes untrusted content from web pages. When such a flaw is critical, it can let a crafted page affect memory in ways that lead to code execution. Google has not disclosed technical details for most of the new bugs, which is standard practice while the update reaches users.
What the Release Does Not Say About Exploitation
Google has not reported exploitation of any of the 213 fixes. That separates this release from emergency Chrome updates that address a zero-day already used in attacks. The absence of exploitation reports is not a guarantee, though, because attackers often study patches after release to work out the bugs they fix.
The sheer number of fixes makes the update harder to treat as routine. An organization with a managed fleet needs to confirm that browsers reach 157.0.8103.38 or later across Linux, Windows and Mac systems, and the staged rollout means that some machines will lag unless administrators push the update.
The credit list also shows where bugs are being found. Of the 84 critical and high-severity bugs Google lists, 38 were reported by Google’s own teams. Anthropic researchers assisted by Claude reported 12 of the listed bugs, and OpenAI Codex Security found five more. Google has not published a full breakdown of who reported the remaining bugs, and the rewards figures cover only the largest payouts in the release.
The critical Prerender flaw credited to the Anthropic researchers is the only one of the seven critical bugs the available reporting names, so details on the other six are not yet public. Google typically restricts bug details until most users have updated, which is consistent with the staged rollout described for Chrome 157.
How to Confirm Chrome 157 Is Installed
Users can update Chrome through its built-in update mechanism and restart the browser to apply the fix. Because the rollout is gradual, a manual check can bring the update sooner. Administrators who manage Chrome on many machines should verify the version string against 157.0.8103.38 and treat the release as a priority patch given the number of critical memory bugs.
With no known exploitation, the immediate risk is low. The risk grows as details emerge, so installing the update early is the lasting defense.
