Chrome update closes 83 security vulnerabilities

Google moved Chrome’s stable release to 157.0.8103.78 on November 11. The version, distributed as 157.0.8103.78/.79 on Windows and Mac and 157.0.8103.78 on Linux, includes 83 security fixes. Five of them are classified as critical by Google’s own rating system.

All five critical flaws are use-after-free

The vulnerabilities marked critical are CVE-2026-126885 (ServiceWorker), CVE-2026-126895 (CSS), CVE-2026-126879 (Layout), CVE-2026-126846 (Skia), and CVE-2026-126911 (Accessibility). What all five have in common is the same bug class: use-after-free. This type of bug happens when code continues accessing an object after its memory has been freed, giving an attacker a chance to write to memory.

Google says most bug details are being kept restricted until users update. The Skia-related flaw, CVE-2026-126846, was reported by Google’s own team, while the ServiceWorker issue was reported by Xinyang Ge.

Bugs that break out of the sandbox

There are also some notable high-severity flaws. CVE-2026-126842 in the ANGLE component reaches 9.6 in the NVD scoring and allows code execution outside the sandbox through a crafted HTML page. Two flaws in the FileSystem component (CVE-2026-126859, CVE-2026-126860) can also lead to file access through social engineering via link following and improper authorization.

Multiple flaws were also fixed in the V8 engine, with CVE-2026-126864 and CVE-2026-126847 leading the list. The same package also includes an integer overflow in Skia (CVE-2026-126876), an out-of-bounds write in the GPU (CVE-2026-126848), and a use-after-free in MediaStream (CVE-2026-126852).

How to update

If the update doesn’t arrive on its own, it’s enough to type chrome://settings/help into the address bar; the page will check the version and download the new package. After that, you need to fully close and reopen the browser, because open tabs will keep running the old version. On Android, the update comes through the Play Store.

Chrome-based browsers will also receive the same Chromium fixes. In browsers like Edge, Brave, Opera, and Vivaldi, it’s normal for the update to be delayed by a few days; however, for critical flaws, that delay increases the risk.

Google did not report any actively exploited flaw in this release. That does not mean the issues are merely theoretical: use-after-free bugs are one of the most commonly used classes of browser vulnerabilities, and they can start being exploited before the patch is widely deployed. That’s why it’s best not to postpone the update.

Source: Chrome Releases · NVD