Skip to content
Hacker Posts

Chrome 157 patches 213 flaws, seven critical, none exploited

Google's Chrome 157 stable release fixes 213 security bugs, seven of them critical memory-safety flaws. Google reports no in-the-wild exploitation. Update and restart the browser.

Published 3 min read
advisorychromegooglebrowser

Google promoted Chrome 157 to the stable channel with fixes for 213 security vulnerabilities, seven of them rated critical. The primary source is Google's stable channel update; SecurityWeek tallied the severity breakdown. Versions are 157.0.8103.38/.39 on Windows and macOS and 157.0.8103.38 on Linux, rolling out over the coming days and weeks.

What's fixed

  • 7 critical — all memory-safety bugs. Google's own release note describes four use-after-free defects and one buffer overflow among them, plus a critical buffer overflow in the Dawn WebGPU implementation and a memory-corruption bug in ANGLE.
  • 77 high severity.
  • The remaining fixes span medium and low severity.

Google is not publishing CVE IDs or deep technical detail yet — standard practice until a majority of users have the update. Treat the specific flaw list as pending.

Exploitation status

None. Per SecurityWeek, "Google makes no mention of any of these security defects being exploited in the wild," and nothing here is listed in CISA's KEV catalog. This is a routine-but-large patch batch, not an emergency zero-day push.

Bounties and credits

Google paid at least $31,000 to external reporters and has not yet set bounties for 39 of the flaws. Named rewards include $10,000 for the Dawn buffer overflow and $1,000 for the ANGLE memory-corruption bug. Of the seven critical bugs, Google's own researchers reported two, Anthropic's Xinyang Ge reported two, and Wenbin Liu reported one.

Action checklist

  1. Update now. Open chrome://settings/help to force the version check, then relaunch — the patch does not apply until the browser restarts, and users who leave Chrome open for days stay exposed.
  2. Confirm the build is 157.0.8103.38 or later (.39 on some Windows/macOS channels).
  3. Managed fleets: push the update through your management channel and verify rollout rather than trusting background auto-update, which staggers over days.
  4. Chromium downstreams (Edge, Brave, Vivaldi, Electron apps) inherit these flaws — watch for and apply their respective releases.

Context

Memory safety still dominates critical browser bugs: all seven criticals here are use-after-free or buffer-overflow class, the same pattern that drives Chrome's multi-year migration of components toward memory-safe code and sandboxing. The volume — 213 fixes in one stable bump — reflects how much of that surface is found by fuzzing and automated analysis rather than one-off reports, and increasingly by outside AI-assisted researchers alongside Google's own team. The operational takeaway is unchanged: the gap between a Chrome release and your fleet actually restarting is the window that matters.

Related stories