Computer Repair · November 9, 2026 · ComputerKing Team

Chrome 157 Fixes 213 Security Issues, Seven Rated Critical: Check Your Version in 30 Seconds

On 3 November, Google promoted Chrome 157 to the Stable channel, fixing 213 security issues in one release, seven of them rated Critical — including a flaw that lets a malicious page run code outside the sandbox. Chrome updates itself, but the rollout is staged and a browser left open never applies the update. This guide shows how to check your version against 157.0.8103.38 or .39 in 30 seconds, and what to do if the update seems stuck.

Key points

On 3 November 2026, Google promoted Chrome 157 to the Stable channel for Windows, Mac and Linux, with Android and iOS builds following. The release fixes 213 security issues at once, seven of them rated Critical by Google, the highest severity, plus 77 High. The one to know about is CVE-2026-121035: a use-after-free flaw in Prerender that can let a malicious page run code outside the sandbox — and the sandbox is supposed to be the last line of defence. Google has not said any of these flaws are being exploited in the wild, but once a fix is out, attackers can work backwards from the patch to find the flaw, so waiting only raises the risk. Checking is simple: open chrome://version and see whether you are on 157.0.8103.38 or .39. If not, restart the browser and let it update.

1. What happened: Chrome 157 on 3 November, 213 fixes

• Version numbers: 157.0.8103.38 or .39 for Windows and Mac, 157.0.8103.38 for Linux, .38 for Android (then .46 on 5 November), and .37 for iOS.
• Scale: 213 security fixes — 7 Critical, 77 High, 75 Medium, 54 Low.
• Rollout: staged over days to weeks, so not every machine had it on 3 November.
• Google has not said any flaw in this release is being exploited in the wild, unlike some past emergency updates. Do not take that as a reason to wait — section 6 explains why.

2. What the most serious ones are

• CVE-2026-121035 (Critical): a use-after-free flaw in Chrome's Prerender feature. An attacker can use a crafted page to run code outside the browser sandbox. The sandbox exists to contain web page code — this flaw goes straight through it.
• CVE-2026-121229 (Critical): memory corruption in the ANGLE graphics translation layer, again allowing code execution outside the sandbox through a crafted HTML page.
• CVE-2026-121156 (Critical): a buffer overflow in Dawn, the WebGPU implementation.
• The other four Critical flaws and 77 High ones span V8, graphics, media and more. There is no need to memorise them — the point is that so many fixes at once means older versions carry a large known attack surface.

3. The 30-second check: are you already on 157?

1. In the Chrome address bar, type chrome://version and press Enter.

2. Look at the version number after Google Chrome on the first line: Windows and Mac should show 157.0.8103.38 or .39; Linux should show 157.0.8103.38.

3. If you are already on 157, you are done. If you are still on 156 or older, go to the next step.

4. Open chrome://settings/help and Chrome will check for updates and download them. If you see a Relaunch button, click it — without a restart the update is not applied. Many people think they have updated when they have only downloaded it.

4. If the update seems stuck

• Browser left open for days: Chrome will not force a restart while you are using it. Restarting once is the most common fix.
• Check whether automatic updates are on: chrome://settings/help shows any error. On a work PC, updates may be controlled by a management policy rather than by you.
• Extensions getting in the way: there are reports of some extensions slowing down the automatic update process. Try disabling recently installed extensions and checking again.
• Version number refuses to move: close Chrome completely, including its icon in the system tray, then reopen it. If it still does not move, back up your bookmarks and reinstall Chrome.
• Never download a so-called Chrome update installer from an unfamiliar website — fake updaters are a common malware route. Update only through Chrome itself or Google's official site.

5. Check your phone too

• Android: Chrome 157 arrived as .38 on 3 November, then .46 on 5 November, rolling out through Google Play in stages. Check Google Play to see whether Chrome has an update waiting.
• iPhone and iPad: Chrome 157 is .37, delivered through the App Store.
• Check the computer and the phone separately — updating the computer does not update the phone.

6. Why you should not wait: once the fix is public, the flaw is no longer secret

• Each time Google ships a fix, it publishes the flaw category and the affected component. Attackers can compare the code before and after the patch to work out how to trigger the flaw.
• This is not theoretical: in the past, exploits for critical browser flaws have appeared within days of the fix being released. Google has not said anyone is exploiting this release yet, but time is not on your side.
• The browser is the first door most people meet malicious pages through: one link, one ad, one compromised website can be the way in. If the browser itself is vulnerable, the whole defence has a hole in it.
• The good news is that checking and updating are free and take only a few minutes. The worst option is not a failed update — it is ignoring the update entirely.

7. When to bring it in

• Chrome keeps reporting update failures, or the version number stays on an old build.
• You suspect you clicked a fake update ad or installed an updater from an unknown source.
• The machine is a work PC with updates locked by policy.
• In these cases, bringing the machine in for a check is safer than trying things one by one on your own.