Google released Chrome 157 to the stable channel on November 11, fixing 83 security flaws. The batch includes five critical use-after-free bugs and 78 high-severity issues, and no exploitation has been reported for any of them.
Chrome 157 Builds for Windows, Mac and Linux
The updated builds are 157.0.8103.78 and 157.0.8103.79 for Windows and Mac, and 157.0.8103.78 for Linux. Securityonline reported the figures.
The Five Critical Use-After-Free Bugs
Each of the five critical flaws is a use-after-free in a different Chrome component. Securityonline lists them as follows.
ServiceWorker, CSS and Layout Components
The ServiceWorker bug is CVE-2026-126885. The CSS bug is CVE-2026-126895. The Layout bug is CVE-2026-126879.
Skia CVE-2026-126846 and Accessibility CVE-2026-126911
The Skia bug is CVE-2026-126846, and the Accessibility bug is CVE-2026-126911. Use-after-free bugs in browser components can lead to code execution when a user visits a crafted web page, according to the report.
V8 Accounts for 17 of the Fixes
The V8 JavaScript engine accounts for 17 of the 83 fixes. The source does not break down which of the 78 high-severity issues fall under V8, or give CVE identifiers for them.
No Exploitation, Unlike the Previous Update
The release differs from the one that preceded it. The November 10 Chrome update fixed zero-day CVE-2026-125350, which attackers had used, and which was covered in an earlier report. Chrome 157 has no such exploitation reported, so this update is a large batch of patches rather than an emergency fix.
Anthropic Claude and OpenAI Codex Security Credited With Finds
Several reports credit Anthropic researchers assisted by Claude and OpenAI Codex Security. The credit lines indicate that AI-assisted tools contributed to finding some of the vulnerabilities in this release. The Securityonline report does not state how many of the 83 flaws came from those sources.
What the Batch Means for Chrome Users
The size of the release stands out. Eighty-three fixes in one stable update, with five rated critical and 78 high, is a heavy load for a single cycle. The use-after-free class of bug appears across all five critical entries, which is a common source of serious browser vulnerabilities.
Google has not released details on how any of the flaws could be triggered, a practice that typically delays technical disclosure until most users have updated. The coverage relies on a single source, and the original Chrome release notes list additional detail that the report does not reproduce.
Users receive the update through Chrome’s normal update mechanism, and the browser applies it after a relaunch. Because the fixes cover Windows, Mac and Linux builds, the exposure applies across all three desktop platforms. No specific attack campaign is linked to the five critical bugs, and the report does not describe any proof-of-concept code. The previous day’s zero-day is the only Chrome flaw in this period with confirmed exploitation.
Sources and Reporting Notes on the Chrome 157 Release
Securityonline is the sole source for the Chrome 157 details, including the version numbers, the five critical CVE identifiers and the count of V8 fixes. The November 10 update that fixed the exploited zero-day CVE-2026-125350 was covered in a separate report and appears here only as context.
The split between the two releases is notable. The November 10 update responded to active exploitation, while the November 11 release is a scheduled stable-channel batch with 83 fixes. The sources give no indication that attackers used any of the five critical use-after-free bugs, and the report credits outside researchers, including AI-assisted ones, for several of the discoveries.
Mac and Windows users receive builds numbered .78 and .79, while Linux users receive .78, a difference the report notes without further explanation.
