Chrome 157 fixes 213 security flaws, and 21 were found with help from AI tools

What is in the update

Google's release note is short on detail on purpose. It says access to bug reports "may be kept restricted until a majority of users are updated", which is standard for Chrome. What it does publish is the list: 213 security fixes, each with a severity, a component and the person or team that reported it.

The most common type is use-after-freethe program keeps using a piece of memory after releasing it; an attacker who controls what gets written there can sometimes take over, with 45 entries. Next come incorrect authorization (37) and misleading interface elements (19), the kind of bug that can make a fake page look trustworthy.

The seven critical flaws

All seven were published as CVEs on November 3. Each record describes a crafted web page that could let a remote attacker run code, and most say "outside the sandboxthe restricted area where the browser runs web pages, so that a bug in a page cannot reach the rest of the computer", which is what makes them critical. CISA added a CVSS 3.1 score of 9.6 to six of them and 8.8 to CVE-2026-121203.

• CVE-2026-121156 and CVE-2026-121247: buffer overflows in Dawn, Chrome's graphics engine for WebGPUa newer web standard that lets pages use the graphics card for games, 3D and AI workloads. The second one, according to its record, affects Chrome on Android.
• CVE-2026-121229: memory corruption in ANGLE, the layer that translates graphics calls, on Android.
• CVE-2026-121246: use-after-free in WebGL, on Android.
• CVE-2026-121035: use-after-free in Prerender, the feature that loads a page before you click it.
• CVE-2026-121203: use-after-free in Geometry.
• CVE-2026-121126: use-after-free in Core.

Four of the seven are in graphics code (Dawn, ANGLE and WebGL), which runs content from web pages on the computer's graphics chip.

AI tools are now on the credits list

Of the 213 fixes, 130 were reported by Google itself. Among outside reports, 21 name an AI tool. Fourteen were reported by two Anthropic researchers, Xinyang Ge and Vlad Stolyarov, "assisted by Claude", including the critical CVE-2026-121035. Seven came from OpenAI Codex Security. Most of the AI-assisted findings, 16 of the 21, are rated high.

The credits say who reported each bug. They do not say how much of the work the tools did, so the split between people and software is unknown. What the list does show is that AI-assisted research found about one in ten of this release's security fixes. The same theme comes up in the Mistral Large 4 release, whose maker reports scores for finding and fixing vulnerabilities.

How to update

Chrome updates itself, but the new version only takes effect after a restart. On a computer, open the menu, go to Help > About Google Chrome, wait for the download and click Relaunch. The version shown should be 157.0.8103.38 or later. On Android, update Chrome from Google Play, since three of the critical flaws affect the Android version.

Google says the release rolls out "over the coming days/weeks", so a computer that has not restarted Chrome in a while may still be on 156. Companies that manage Chrome centrally should check their update policies.

Other browsers and phones got large patch sets the same fortnight: Mozilla fixed 167 vulnerabilities in Firefox 159, and Google's Android November 2026 bulletin covered 216.