# Chrome 157: update and relaunch after seven critical fixes

Canonical: https://www.oktsec.com/radar/google-chrome-157-security-update
Publisher: Oktsec
Language: en
Published: 2026-11-04T09:56:42Z
Updated: 2026-11-04T09:56:42Z
Record reviewed: 2026-11-04T09:56:42Z
Latest evidence check: 2026-11-04T09:56:42Z
Disclosed: 2026-11-03

Google released Chrome 157 with 213 security fixes, including seven rated Critical. The reviewed announcement does not report active exploitation.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Act now
- Rationale: Seven critical fixes in a widely used browser justify prompt rollout. Severity and patch availability do not establish active exploitation.
- Evidence: Attacks not established
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: Google
- Products: Chrome for Windows, Chrome for macOS, Chrome for Linux
- CVEs: CVE-2026-121156, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121247, CVE-2026-121203, CVE-2026-121126

## Technical overview

The seven critical entries cover Dawn, ANGLE, WebGL, Prerender, Geometry and Core. They are part of the broader 213-fix release, not the complete list of vulnerabilities addressed. Google says distribution will take place over days or weeks.

This advisory covers desktop Chrome on Windows, macOS and Linux. Check separate vendor notices for other Chromium-based browsers and other operating systems; their version numbers and update schedules are not interchangeable.

Oktsec recommends tracking the version actually running after relaunch, especially on unattended browser hosts. A downloaded update alone is not sufficient evidence that an active session uses the corrected code.

## Recommended response

Update desktop Chrome, relaunch it and verify the running version across the managed fleet.

Relevant to: Teams managing desktop Chrome installations, including shared workstations and browser automation hosts.

## CVE attribution

- CVE-2026-121156: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- CVE-2026-121229: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- CVE-2026-121246: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- CVE-2026-121035: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- CVE-2026-121247: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- CVE-2026-121203: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)
- CVE-2026-121126: Google — Chrome. [Source](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html)

## Affected systems and fixes

### Chrome for Linux

Affected: Desktop stable installations predating the Chrome 157 security release.

Fixed release / action: 157.0.8103.38

### Chrome for Windows and macOS

Affected: Desktop stable installations predating the Chrome 157 security release.

Fixed release / action: 157.0.8103.38; 157.0.8103.39

Confirm the running version against the vendor advisory, including any distribution backports.

## CISA KEV evidence

Catalog: 2026.11.03
Checked: 2026-11-03T22:13:58Z

No matching CVE appears in the reviewed catalog snapshot.

CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America.

## Supporting evidence

Snapshot checked: 2026-11-04T12:33:51.947Z. These dates do not change the incident’s editorial review date.

### FIRST EPSS forecast


No score returned for: CVE-2026-121156, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121247, CVE-2026-121203, CVE-2026-121126

EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-04T12:33:51.947Z.

## Response checklist

1. **Find desktop Chrome installations** — Oktsec recommends including managed, unmanaged, shared and unattended hosts. Record which executable each automation workload uses.
2. **Roll out the stable security release** — Use the official Chrome update channel or your managed deployment process. Check rollout failures and devices that cannot yet obtain the release.
3. **Relaunch and verify the runtime** — Save work, relaunch Chrome and record the running version. Confirm that long-lived sessions and scheduled browser jobs restart with the updated executable.
4. **Resolve fleet exceptions** — Assign an owner to offline devices and failed updates. Apply your normal temporary restrictions for unpatched endpoints and verify completion rather than relying only on an installation report.

## Relevance to AI environments

Oktsec recommends checking the actual Chrome executable used by browser agents and automation; updating a workstation browser may not update a separately installed runtime.

## Sources

- [Chrome 157: desktop stable security release](https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html) — Google; Vendor notice; checked 2026-11-04T09:49:59Z

## Editorial record

- 2026-11-04T09:56:42Z: Added source-backed scope, evidence distinctions and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/google-chrome-157-security-update) · [Build a response plan](https://www.oktsec.com/radar/google-chrome-157-security-update#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=google-chrome-157-security-update&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=google-chrome-157-security-update&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.