Chrome Security Update November 2026: Chrome 157 Fixes 213 Flaws, 7 Critical

Last updated: November 11, 2026. By Veer. Facts checked against Google’s Chrome 157 Stable Channel Update, Chrome for Android update and Extended Stable update (all November 3), Google’s Chromium Dash schedule, CISA’s KEV catalog (version 2026.11.03), Microsoft’s Edge security release notes, Mozilla’s security advisories, Google’s Update Google Chrome help page, and reporting from SecurityOnline and HKCERT. This is a researched news explainer. Severity counts are our own tally of Google’s release note.

Update, November 11, 2026: Chrome zero-day. Google’s November 9 Stable update (157.0.8103.50/.51 on Windows and Mac, 157.0.8103.50 on Linux and Android) fixes 9 more security flaws, including CVE-2026-125350, a High-severity use-after-free in Chrome’s XML component. Google says it “is aware that an exploit for CVE-2026-125350 exists in the wild.” CISA added it to its KEV catalog on November 10, with a federal deadline of November 24. Extended Stable moved to 156.0.8078.96. For Edge, Microsoft said on November 9 it is “actively working on releasing a security fix.” BleepingComputer counts it as Chrome’s eighth exploited zero-day of 2026. Microsoft’s same-week Windows and Outlook fixes are in our November 2026 Patch Tuesday guide.

Update, November 6, 2026: Microsoft Edge Stable 157.0.4341.42 shipped on November 5 with Chromium security updates, and Extended Stable moved to 156.0.4314.70. Microsoft’s security release notes say CVEs will be added when available. Open edge://settings/help to update.

What is in the Chrome security update for November 2026?

Chrome 157 fixes 213 security bugs, the biggest batch since Chrome 156’s 353 fixes in October. Google’s release note says the update “includes 213 security fixes” and that it “will roll out over the coming days/weeks.” We counted every entry in the note. The split is:

Source: Google’s Chrome 157 Stable Channel Update, November 3, 2026, counted by TrustLoud. SecurityOnline also reports 7 Critical and 77 High.

For comparison, Google’s October updates were smaller. Chrome 155 fixed 37 flaws on October 13, and Chrome 156 fixed 353 when it reached Stable on October 20, followed by two more Chrome 156 builds with 52 fixes (October 27) and 21 fixes (October 29). Our October 2026 Chrome security update explainer covers those releases.

The most common bug types in Chrome 157 are use-after-free errors (45 of the 213) and incorrect authorization bugs (37). Use-after-free bugs are the classic route to code execution in a browser, because the program keeps using memory it has already released. The component with the most fixes is V8, Chrome’s JavaScript engine, with 16 bugs (10 rated High), followed by DevTools with 14.

What are the 7 Critical Chrome 157 bugs?

Four of the seven Critical bugs are in Chrome’s graphics stack: Dawn (WebGPU), ANGLE and WebGL. Bugs there are attractive to attackers because any web page can reach them through graphics code.

Source: Google’s Chrome 157 release note. Google keeps bug details private “until a majority of users are updated with a fix.”

Google hasn’t published technical details for any of these, which is normal. HKCERT, Hong Kong’s computer emergency team, rates the update Medium Risk and says the flaws could allow remote code execution, denial of service, information disclosure, elevation of privilege and security restriction bypass.

Are any Chrome 157 bugs being exploited?

Yes, since November 9: CVE-2026-125350 is exploited in the wild and fixed in Chrome 157.0.8103.50/.51 (see the update at the top). The rest of this section covers the original November 3 release.

Not in the November 3 release. Google’s November 3 note doesn’t say an exploit exists for any of the 213 bugs, and none of them is in CISA’s Known Exploited Vulnerabilities catalog. When Google knows about attacks, its release note says it is “aware that an exploit for CVE-… exists in the wild.” This note has no such line.

We checked CISA’s KEV catalog (version 2026.11.03, published November 3). It has no entry for any Chrome 157 CVE. The most recent Chromium entries are both V8 bugs from September: CVE-2026-85046 (added September 4) and CVE-2026-87491 (added September 9). So Chrome has gone almost two months without a known zero-day.

“Not exploited” doesn’t mean safe to skip. Once a fix is public, attackers can compare old and new code to find the bug. That’s why Google hides details at first, and why it’s worth relaunching Chrome this week rather than whenever it suits you.

Which Chrome version should you have?

On a computer, you want 157.0.8103.38 or later (Windows and Mac may show .39). On Android, 157.0.8103.38 or later. Here’s where each Chrome channel stands as of November 4:

Sources: Google Chrome Releases (November 3), Chromium Dash, Microsoft Edge security release notes (checked November 6).

A small share of users got an early Stable build of Chrome 157 (157.0.8103.26/.27) on October 28 (Windows first, with Mac “coming shortly”). If you’re on that build, you still need to update to .38/.39 for the full set of fixes listed on November 3.

Google’s schedule also shows a Chrome 157 “stable refresh” on November 10, so expect another point update next week. Google’s schedule now spaces major versions two weeks apart: Chrome 156 arrived on October 20, Chrome 157 on November 3, and Chrome 158 is set for November 17.

Who found these Chrome bugs?

Google’s own teams found most of them, but AI-assisted research shows up all over this release. By our count of the reporter credits:

Source: reporter credits in Google’s Chrome 157 release note, counted by TrustLoud. Some researchers, such as Xinyang Ge, appear both with and without the Anthropic credit; we only counted entries that say Anthropic.

That’s 21 of the 213 credits going to researchers at two AI companies, including one Critical bug. The same pattern was visible in October’s Chrome 156 builds, where Anthropic-credited researchers reported two of the four Critical bugs on October 27. Bugs found by defenders before attackers find them is good news, but it also helps explain why patch batches keep getting bigger.

The bounties listed so far are small. Of the amounts Google has published, the total is $31,000, led by $10,000 for the Dawn buffer overflow. Most entries say “N/A” (found internally or not eligible) or “TBD.”

Should you update Chrome now?

Yes, now. Since November 9 there is a known attack (CVE-2026-125350), so make sure you’re on 157.0.8103.50 or later. Here’s what to do depending on who you are:

• Home users on Windows, Mac or Linux: Check your version and relaunch. Chrome restores your tabs.
• Android users: Update Chrome in Google Play. Also install the Android November 2026 security update when your phone offers it, since that patches the operating system underneath.
• iPhone and iPad users: Chrome for iOS updates through the App Store, and Google hadn’t posted a Chrome 157 iOS release as of November 4. Keep iOS itself updated too; our iOS 26.7.1 security update guide explains why older iPhones still need patches.
• Edge users: Update to Edge Stable 157.0.4341.42 (or Extended Stable 156.0.4314.70) via edge://settings/help.
• Businesses: Push Chrome 157.0.8103.50/.51 through your management tool, or 156.0.8078.96 if you use Extended Stable.

If your PC is still on an old version of Windows, check our Windows end of support calendar. Google’s help page says Chrome on Intel PCs needs Windows 10 or later, and on ARM PCs Windows 11 or later. On a Mac, Chrome needs macOS 13 Ventura or later.

How do you update Chrome?

On a computer, open Chrome, select More (three dots) > Help > About Google Chrome, then click Relaunch. That’s Google’s own method from the Update Google Chrome help page. If there’s no Relaunch button, you’re already on the latest version.

1. Open Chrome.
2. Click the three dots at the top right.
3. Go to Help > About Google Chrome. Chrome checks for updates on this page.
4. Click Relaunch. Your normal tabs and windows reopen, but Incognito windows won’t.
5. Go back to About Google Chrome and confirm the version starts with 157.0.8103.38 or higher.

On Android, open the Google Play Store, search for Chrome and tap Update. On Linux, Google says to update through your package manager. On a Chromebook or Googlebook, Chrome updates with the operating system, so check for a ChromeOS update instead. Google hadn’t posted a Chrome 157 ChromeOS release as of November 4.

What’s new in Chrome 157 besides security?

Mostly developer features. According to Google’s Chrome 157 release notes, as summarized by GIGAZINE, the release brings the on-device Language Detector API to Chrome for Android, a new CSS corner shorthand property, custom strings for text-overflow (instead of only “…”), and a text-decoration-inset property for adjusting underlines. You won’t notice much as a regular user.

What about Firefox?

Firefox had its big update a week earlier. Mozilla released Firefox 159 on October 27 with 167 security fixes (108 High, 52 Moderate, 7 Low), according to its MFSA 2026-118 advisory. Mozilla now publishes one advisory entry per bug instead of grouping memory-safety issues together, which partly explains the large number. On November 3 it followed up with Firefox 159.0.1, which fixes one more High-impact bug (MFSA 2026-123). In Firefox, open the menu, then Help > About Firefox, and restart when prompted.

Timeline: Chrome security updates, October to November 2026

Sources: Google Chrome Releases for October and November 2026 and the Chromium Dash schedule.

FAQ

What is the latest Chrome security update?

Chrome 157.0.8103.50/.51 (157.0.8103.50 on Linux and Android), released November 9, 2026. It fixes 9 flaws, including the exploited zero-day CVE-2026-125350. It follows the main Chrome 157 release on November 3, which fixed 213 security flaws, 7 of them Critical.

Is Chrome 157 safe to install?

Yes. It’s Google’s regular Stable release, and installing it fixes 213 known security bugs. For most people, staying on an older version is the bigger risk.

Is there a Chrome zero-day in November 2026?

Yes. On November 9, 2026, Google fixed CVE-2026-125350, a use-after-free in Chrome’s XML component that is being exploited in the wild, in Chrome 157.0.8103.50/.51. CISA added it to its KEV catalog on November 10, with a federal deadline of November 24.

How do I check my Chrome version?

Open Chrome, click the three dots, then Help > About Google Chrome. The version number appears under the Google Chrome heading. It should start with 157.0.8103.50 or higher.

Why hasn’t my Chrome updated yet?

Google rolls the update out “over the coming days/weeks,” and Chrome usually applies it only when you relaunch. Opening About Google Chrome forces a check, and clicking Relaunch installs it.

Is Microsoft Edge affected?

Yes. Microsoft shipped Edge Stable 157.0.4341.42 on November 5, 2026 with Chromium security updates, and Extended Stable 156.0.4314.70 the same day. Microsoft’s security notes say the CVE list will be added when available. Update via edge://settings/help.

When is the next Chrome update?

Google shipped the Chrome 157 refresh (157.0.8103.50/.51) on November 9, fixing an exploited zero-day. Chrome 158 is scheduled for November 17, 2026. Security fixes can also arrive in between if Google needs to patch an urgent bug.

Sources

• Google, Chrome Releases: Stable Channel Update for Desktop, Chrome for Android Update and Extended Stable Update for Desktop (November 3, 2026); October 2026 updates of October 27 and October 29
• Google, Chromium Dash release schedule (Chrome 157 and 158 milestones)
• Google, Update Google Chrome, Chrome Help
• Google, Chrome 157 release notes, Chrome Platform Status
• CISA, Known Exploited Vulnerabilities Catalog (version 2026.11.03)
• Microsoft, Release notes for Microsoft Edge Security Updates (checked November 6, 2026)
• Mozilla, MFSA 2026-118: Firefox 159 and MFSA 2026-123: Firefox 159.0.1
• SecurityOnline, Chrome 157 Security Update Fixes 213 Flaws, Including Seven Critical Bugs (November 3, 2026)
• HKCERT, Google Chrome Multiple Vulnerabilities (November 4, 2026)
• GIGAZINE, Google Chrome 157 stable version released (November 4, 2026)