Google Rolls Out Chrome 157 With 213 Fixes, Seven Critical
Google promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities, seven of them critical, mostly memory safety bugs. Versions 157.0.8103.38/.39 (Windows and macOS) and 157.0.8103.38 (Linux) are rolling out now. Google makes no mention of in-the-wild exploitation, but urges users to update as soon as possible.
What happened
Google released Chrome 157 to the stable channel with 213 security fixes, seven of them critical. The critical flaws are memory safety bugs such as buffer overflows and use-after-free in browser graphics components (Dawn and ANGLE). The update is rolling out automatically.
Why it matters
The fixed flaws include 51 cases of incorrect or missing authorization and 45 use-after-free bugs, issues that can enable code execution or unauthorized access. Chrome is the dominant enterprise browser, so any endpoint on an older version stays exposed. Google reports no active exploitation so far.
What to do
Update every browser to Chrome 157 now: 157.0.8103.38/.39 on Windows and macOS, 157.0.8103.38 on Linux. Force the update through your endpoint management tool and verify the installed version today.
For the technical team
- Affected
- Google Chrome · Google Chrome stable versions prior to 157.
- Exploitation
- No exploitation reported. Google makes no mention of any of these flaws being exploited in the wild, per SecurityWeek. No PoCs cited.
- Fix
- Chrome 157: 157.0.8103.38/.39 for Windows and macOS; 157.0.8103.38 for Linux. Rolling out to the stable channel.
- Vector
- Browser components: buffer overflow in Dawn (the WebGPU standard implementation), memory corruption in ANGLE (graphics engine abstraction layer), plus four critical use-after-free defects and one critical buffer overflow. Also fixes incorrect or missing authorization, type confusion, and out-of-bounds read/write. Exploitation conditions are not detailed in the sources.
- More details
- Google paid out $31,000 in rewards and has not yet set bounties for 39 of the flaws, per the advisory cited by SecurityWeek. The Dawn buffer overflow earned $10,000; the ANGLE memory corruption earned $1,000. Of the other five critical bugs, Google reported two, Anthropic's Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth. Most common flaw types: incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), uninitialized resource (9). The update also fixes 77 high-severity vulnerabilities.
Timeline
First entry: Chrome 157 release with 213 security fixes.
