# Chrome 157 stable release patches 213 security flaws, including 7 critical CVEs

> **Key takeaway:** Chrome 157.0.8103.38 for Linux resolves 213 security vulnerabilities, with seven rated critical including multiple buffer overflows in Dawn and use-after-free bugs in WebGL, ANGLE, and Core components.

**Published:** 2026-11-03T20:38:18.791000+00:00 
**Source:** Google Chromium Engineering Releases 
**Category:** bigtech-foss 
**Canonical URL:** https://fosswire.org/news/chrome-157-stable-release-patches-213-security-flaws-includi.html 

## Summary
Google has promoted Chrome 157 to the stable channel for Windows, Mac, and Linux, with the Linux build arriving as version 157.0.8103.38. The release contains 213 security fixes total, including seven critical-severity vulnerabilities: buffer overflows in the Dawn WebGPU implementation (CVE-2026-121156, CVE-2026-121247), memory corruption in ANGLE (CVE-2026-121229), use-after-free flaws in WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203), and Core (CVE-2026-121126). Several critical bugs were discovered with assistance from AI systems, including Anthropic's Claude and OpenAI's Codex Security team.

The remaining fixes span high-severity issues across GPU, PDFium, Media, XML, SVG, FileSystem, CacheStorage, and other subsystems. Notable external reporters include Zhenpeng Lin, who earned $10,000 for the Dawn buffer overflow, and Johan Carlsson, who received the same amount for an authorization flaw in BackgroundFetch. Google is withholding detailed bug information until most users have updated, particularly for vulnerabilities in third-party libraries that other projects depend upon.

## Critical vulnerability breakdown and AI-assisted discovery
- **Dawn/WebGPU:** Two critical buffer overflows (CVE-2026-121156, CVE-2026-121247) in Google's WebGPU implementation, one netting a $10,000 bug bounty to Zhenpeng Lin from depthfirst.
- **ANGLE graphics layer:** Critical memory corruption (CVE-2026-121229) and a high-severity out-of-bounds read (CVE-2026-121197) in the OpenGL ES translation layer used across platforms.
- **WebGL and GPU subsystem:** Critical use-after-free in WebGL (CVE-2026-121246) plus multiple high-severity uninitialized resource and memory corruption bugs in GPU and WebGL components.
- **AI-assisted vulnerability research:** Multiple critical and high CVEs were reported by Xinyang Ge at Anthropic with assistance from Claude, and by OpenAI Codex Security (amyb), marking continued integration of LLM tools in security research workflows.
- **Third-party library embargo:** Google is restricting access to bug details for flaws in shared dependencies until upstream projects and the majority of users have deployed fixes.

## Why it matters
Linux distributions packaging Chromium and ungoogled-chromium derivatives will need to expedite this update given the volume of critical browser-engine vulnerabilities affecting WebGPU, WebGL, and core rendering paths. The AI-assisted discovery trend visible in this release's credit lines signals a shift in how security research is conducted against complex browser attack surfaces, with implications for how open-source projects triage and validate externally reported flaws.