Chrome 157 fixes 83 flaws, including five critical use-after-free bugs
Original title: Google Chrome Fixes 83 Security Flaws, Including 5 Critical Ones that Could Enable RCE Attacks
Windows and Mac move to 157.0.8103.78/.79 and Linux to 157.0.8103.78; the notice does not report exploitation.
Google released a Chrome Stable update fixing 83 vulnerabilities, including five critical use-after-free flaws and 78 high-severity issues, across Windows, macOS, and Linux. The critical bugs are in ServiceWorker, CSS, Layout, Skia, and Accessibility and could potentially allow remote code execution, though the notice does not describe working exploits or full device compromise. Other fixes cover memory corruption, information leaks, and authorization failures in components including V8, ANGLE, Extensions, PDF, and Site Isolation. The release is rolling out over the coming days and weeks.
Unconfirmed: The notice does not establish that each critical flaw enables full device compromise or that any is exploited.
- Critical IDs are CVE-2026-126885, CVE-2026-126895, CVE-2026-126879, CVE-2026-126846, and CVE-2026-126911.
- Xinyang Ge, Google, and Andrew Boni reported the five critical issues between October 2 and November 2.
- The reward for the Accessibility finding remains pending.
- High-severity fixes include type confusion, buffer overflows, and missing authorization checks.
Impact: Potential remote code execution through use-after-free bugs
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | before 157.0.8103.78/.79 on Windows and Mac and before 157.0.8103.78 on Linux | 157.0.8103.78/.79 for Windows and Mac; 157.0.8103.78 for Linux |
- 1.Update Chrome Stable to 157.0.8103.78/.79 on Windows and Mac or 157.0.8103.78 on Linux.
- CVEs
- CVE-2026-126885CVE-2026-126895CVE-2026-126879CVE-2026-126846CVE-2026-126911CVE-2026-126864CVE-2026-126889CVE-2026-126859CVE-2026-126886CVE-2026-126887CVE-2026-126870CVE-2026-126912CVE-2026-126919CVE-2026-126878CVE-2026-126909CVE-2026-126847CVE-2026-126853CVE-2026-126865CVE-2026-126916CVE-2026-126903CVE-2026-126910CVE-2026-126842CVE-2026-126898CVE-2026-126871CVE-2026-126875CVE-2026-126862CVE-2026-126900CVE-2026-126904CVE-2026-126907CVE-2026-126851
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-126842 | Use-after-free in Chrome ANGLE via crafted HTML | 9.6 group max | — | ||
CVE-2026-126846+1 related CVE | Use-after-free in Skia in Chrome on Android before 157.0.8103.78 | 9.6 group max | — | ||
| CVE-2026-126903 | Origin-policy bypass in Chrome ANGLE on Windows before 157.0.8103.78 | 8.1 | — |
From the original article
4 min read at cybersecuritynews.com
Google released a Chrome security update that addresses 83 vulnerabilities, including five critical use-after-free flaws that could allow remote code execution. According to the supplied release notice, the update covers Windows, macOS, and Linux, with fixes spanning browser rendering, graphics, JavaScript processing, and other core features. The Stable channel moves to version 157.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.