EN PT-BR
← Voltar ao feed
high

Google Chrome 157 fixes 213 vulnerabilities, including seven critical memory-safety flaws in Dawn, ANGLE and WebGL

5 fonte(s) · 4 atualização(ões) · 1 repetição(ões) · publicado 03/11/2026 20:21 · coletado há 14 horas

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 07/11/2026 00:07; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ gbhackers.com ↗ malwarebytes.com ↗ securityweek.com ↗ securityonline.info ↗

Google released Chrome 157 (157.0.8103.38/.39) to the stable channel on 3 November 2026, fixing 213 security issues, an unusually large batch for one release. Seven are rated critical memory-safety bugs: buffer overflows in Dawn (WebGPU), memory corruption in ANGLE and four use-after-free defects (securityonline.info, securityweek.com, gbhackers.com). Google has not reported in-the-wild exploitation of any of the fixes (securityweek.com, securityonline.info, gbhackers.com), and the CERT-FR bulletin does not mention exploitation either (cert.cyber.gouv.fr). Critical browser bugs of this kind could let a malicious web page escape the sandbox and execute arbitrary code (securityonline.info). AI-assisted research played a large part: Anthropic (Xinyang Ge, aided by Claude) and OpenAI Codex Security were credited for 17 of the bugs combined (securityonline.info, gbhackers.com). The full severity breakdown is seven critical, 77 high, 75 medium and 54 low-severity vulnerabilities, matching Google's stated total of 213 fixes (gbhackers.com). CERT-FR relayed the update in bulletin CERTFR-2026-AVI-1450 (cert.cyber.gouv.fr). Users should update promptly.

Entenda a falha

A vulnerabilidade

Chrome 157 fixes 213 security issues, seven of them critical memory-safety bugs. The most severe is CVE-2026-121156 (CVSS 9.6), a buffer overflow in Dawn, Chrome's WebGPU engine. CVE-2026-121247 is a second Dawn overflow. CVE-2026-121229 is memory corruption in ANGLE; Malwarebytes says a remote attacker could use a crafted HTML page to run code outside the sandbox. The other critical flaws are use-after-free bugs: CVE-2026-121246 (WebGL), CVE-2026-121035 (Prerender), CVE-2026-121203 (Geometry) and CVE-2026-121126 (Core). The sources give no prerequisites for these beyond the web-page vector. The remaining CVEs, such as CVE-2026-121029 to CVE-2026-121040, are listed by CERT-FR without details. Affected: desktop Chrome before 157.0.8103.38 (Linux) and 157.0.8103.38/.39 (Windows, Mac). Fixed in those builds; Extended Stable moves to 156.0.8078.88.

Como funciona

Dawn receives WebGPU instructions from a web page, checks them and translates them into commands for the device's graphics system. In the overflow bugs, more data ends up written into a memory block than it can hold, overwriting adjacent memory. Prerender loads and renders a page in the background, including running its JavaScript, so that navigation feels instant. In the use-after-free bugs, code keeps using memory after the browser has released it, so an attacker could plant data there and hijack execution. The articles do not describe the exact step at which each individual CVE goes wrong, since Google keeps those details restricted.

Por que é vulnerável

The critical bugs are memory-safety defects: writing past the end of a buffer (Dawn) and using memory after it was freed (WebGL, Prerender, Geometry, Core), plus memory corruption in ANGLE. The articles do not explain the specific root cause of each CVE or why they went unnoticed, and do not describe what each fix changes. Google withholds bug details until most users have updated.

Como foi descoberta

Google's own teams reported 38 of the 84 critical and high bugs. Xinyang Ge of Anthropic, assisted by Claude, found the Prerender flaw CVE-2026-121035; Anthropic and OpenAI Codex Security were credited for 17 bugs combined. Zhenpeng "Leo" Lin of depthfirst received $10,000 for CVE-2026-121156, @mfx got $1,000 for CVE-2026-121229, and Wenbin Liu reported another critical bug. Google released the fixes in the 3 November 2026 stable update and does not report exploitation in the wild; CERT-FR relayed it in bulletin CERTFR-2026-AVI-1450.

Explicação gerada por IA a partir da matéria e dos artigos, em 07/11/2026 00:22.

Detalhes técnicos

  • CVE-2026-121156 (CVSS 9.6) and CVE-2026-121247: buffer overflows in Dawn (WebGPU) (securityonline.info).
  • CVE-2026-121229: memory corruption in ANGLE (securityonline.info).
  • CVE-2026-121246: use-after-free in WebGL (securityonline.info).
  • CVE-2026-121035: use-after-free in Prerender, found by Xinyang Ge of Anthropic with Claude (securityonline.info, gbhackers.com).
  • CVE-2026-121203: use-after-free in Geometry (securityonline.info).
  • CVE-2026-121126: use-after-free in Core (securityonline.info).
  • Besides the seven critical flaws, 77 are high severity (securityweek.com, gbhackers.com). V8 has 10 high-severity type confusion flaws, and other fixes affect PDFium, Skia, Media and FileSystem (securityonline.info). High-severity fixes also include authorization weaknesses in BackgroundFetch and FileSystem, and use-after-free defects across rendering and interface components (gbhackers.com).
  • Bug classes (securityweek.com): incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), uninitialized resource (9).
  • Google's internal teams found 38 of the 84 critical/high bugs (securityonline.info), including several of the critical flaws (securityweek.com). Other credited reporters include Wenbin Liu (securityweek.com, gbhackers.com).
  • Bug bounty: $31,000 paid so far, with payouts for 39 flaws still undetermined (securityweek.com). Top rewards of $10,000 went to the Dawn overflow and a BackgroundFetch authorization issue (securityonline.info). GBHackers identifies the $10,000 Dawn reward as paid to Zhenpeng "Leo" Lin at depthfirst for CVE-2026-121156, and a $1,000 reward to researcher @mfx for CVE-2026-121229 (gbhackers.com).
  • CERT-FR bulletin CERTFR-2026-AVI-1450 covers a very large batch of CVEs starting from CVE-2026-121029 (the list in the provided text is truncated). It describes the impact only as a "security issue not specified by the vendor", gives no severity or CVSS scores, and lists Chrome versions before 157.0.8103.38 on Linux, Windows and Mac as affected (cert.cyber.gouv.fr).

Remediação

Update to Chrome 157.0.8103.38 on Linux or 157.0.8103.38/.39 on Windows and macOS via Settings > About Chrome, then restart the browser (securityonline.info, securityweek.com, gbhackers.com). CERT-FR likewise advises updating to 157.0.8103.38 or later on all platforms, restarting the browser, and consulting Google's bulletin for the fixes (cert.cyber.gouv.fr). Extended Stable users should update to 156.0.8078.88 on Windows and Mac (securityonline.info). The rollout is gradual over the coming days or weeks (securityonline.info, gbhackers.com).

Relatos divergentes

  • Use-after-free count: securityonline.info reports 35 use-after-free issues, while securityweek.com reports 45. The sources do not explain the difference, and securityweek.com is the more recent. Neither figure is vendor-confirmed in the input.
  • Fixed version wording: cert.cyber.gouv.fr gives 157.0.8103.38 as the fixed threshold for Linux, Windows and Mac, while securityonline.info, securityweek.com and gbhackers.com cite 157.0.8103.38/.39 for Windows and macOS. This is likely a difference in how the builds are described rather than a real disagreement; cert.cyber.gouv.fr is the most recent source.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 06/11 12:00

    CERT-FR flags multiple vulnerabilities in Google Chrome before 157.0.8103.38 (hundreds of CVEs, November 2026 stable update)

    ler a análise desta fonte

    The CERT-FR bulletin CERTFR-2026-AVI-1450 relays the Google Chrome stable channel update of 3 November 2026. It covers a very large batch of CVEs, from CVE-2026-121029 onward. The list in the provided text is truncated. The bulletin says the flaws let an attacker cause a "security issue not specified by the vendor". It does not give severity, impact or CVSS scores. Affected products are Chrome versions before 157.0.8103.38 on Linux, Windows and Mac. The bulletin tells readers to consult Google's bulletin for the fixes. It does not mention exploitation.

    Remediation

    Update Chrome to 157.0.8103.38 or later on all platforms. Restart the browser so the update applies.

  2. gbhackers.com ↗ · pub. 05/11/2026 02:44 · coletado 05/11 03:00

    Google Chrome 157 Patches 213 Flaws, Including Seven Critical Memory-Safety Bugs in Dawn, ANGLE and WebGL

    This article adds specific bug bounty attribution: $10,000 paid to Zhenpeng "Leo" Lin at depthfirst for CVE-2026-121156 (the Dawn buffer overflow) and $1,000 to researcher @mfx for CVE-2026-121229 (the ANGLE memory corruption), details not previously captured in the case report. It also confirms the severity breakdown of 7 critical, 77 high, 75 medium and 54 low vulnerabilities, consistent with but more granular on the medium/low counts than prior sources.

    ler a análise desta fonte

    This article adds specific bug bounty attribution: $10,000 paid to Zhenpeng "Leo" Lin at depthfirst for CVE-2026-121156 (the Dawn buffer overflow) and $1,000 to researcher @mfx for CVE-2026-121229 (the ANGLE memory corruption), details not previously captured in the case report. It also confirms the severity breakdown of 7 critical, 77 high, 75 medium and 54 low vulnerabilities, consistent with but more granular on the medium/low counts than prior sources.

    Google shipped Chrome 157 (157.0.8103.38/.39) fixing 213 security issues, seven rated critical: two buffer overflows in Dawn, memory corruption in ANGLE, and four use-after-free bugs in WebGL, Prerender, Geometry and Core. Google has not disclosed exploitation prerequisites and does not state any flaw is actively exploited in the wild. AI-assisted research again featured prominently, with Anthropic's Xinyang Ge (aided by Claude) and OpenAI Codex Security credited for several reports. Bug bounty payouts included $10,000 to Zhenpeng "Leo" Lin at depthfirst for the Dawn overflow (CVE-2026-121156) and $1,000 to researcher @mfx for the ANGLE flaw (CVE-2026-121229).

    Technical Details

    The disclosed severity breakdown is seven critical, 77 high, 75 medium and 54 low, matching Google's total of 213 fixes. High-severity issues include V8 type confusion, PDFium memory-safety flaws, and authorization weaknesses in BackgroundFetch and FileSystem, alongside use-after-free defects across rendering and interface components.

    Remediation

    Users should verify Chrome has updated via Help > About Google Chrome and relaunch the browser; administrators should prioritize deployment across managed endpoints since rollout is gradual over coming days and weeks.

  3. securityweek.com ↗ · pub. 04/11/2026 07:38 · coletado 04/11 09:00

    Chrome 157 Patches 213 Vulnerabilities, Seven Critical Memory Safety Flaws

    ler a análise desta fonte

    Google released Chrome 157 to the stable channel, fixing 213 vulnerabilities including seven critical memory safety bugs. The most severe issues involve a buffer overflow in Dawn (the WebGPU implementation) and a memory corruption flaw in ANGLE, alongside four use-after-free defects and another buffer overflow. Google paid out $31,000 in bug bounty rewards so far, with payouts for 39 flaws still undetermined. No in-the-wild exploitation has been observed for any of the patched issues, but users are urged to update promptly given the volume and severity of fixes.

    Technical Details

    The update addresses 77 high-severity vulnerabilities in addition to the seven critical ones. Common bug classes include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9). Reporters credited include Anthropic's Xinyang Ge and researcher Wenbin Liu, among others; Google itself discovered several of the critical flaws.

    Remediation

    Chrome 157 is rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and 157.0.8103.38 for Linux. Users should update their browsers as soon as the new version becomes available.

  4. securityonline.info ↗ · pub. 03/11/2026 20:21 · coletado 04/11 08:52 primeiro registro

    Chrome 157 Patches 213 Flaws, Including 7 Critical Memory Corruption Bugs

    ler a análise desta fonte

    Google has released Chrome 157 (157.0.8103.38/.39) to the stable channel, fixing 213 security issues, an unusually large batch for a single release. Seven flaws are rated critical, including buffer overflows in the Dawn WebGPU engine and memory corruption in ANGLE, along with multiple use-after-free bugs in WebGL, Prerender, Geometry and Core. Google has not confirmed exploitation in the wild for any of these issues, but critical browser bugs could allow a malicious web page to escape sandboxing and execute arbitrary code. AI-assisted research played a significant role this cycle, with Anthropic (aided by Claude) and OpenAI Codex Security credited for 17 of the reported bugs combined.

    Technical Details

    • CVE-2026-121156 (CVSS 9.6) and CVE-2026-121247: buffer overflows in Dawn (WebGPU)
    • CVE-2026-121229: memory corruption in ANGLE
    • CVE-2026-121246: use-after-free in WebGL
    • CVE-2026-121035: use-after-free in Prerender (found by Xinyang Ge of Anthropic with Claude)
    • CVE-2026-121203: use-after-free in Geometry
    • CVE-2026-121126: use-after-free in Core
    • Use-after-free bugs account for 35 of the listed issues; V8 has 10 high-severity type confusion flaws; other fixes affect PDFium, Skia, Media and FileSystem.
    • Google's internal teams found 38 of the 84 critical/high severity bugs; top bug bounty rewards were $10,000 for the Dawn overflow and a BackgroundFetch authorization issue.

    Remediation

    Update to Chrome 157.0.8103.38 (Linux) or 157.0.8103.38/.39 (Windows/Mac) via Settings > About Chrome, then restart the browser. Extended Stable channel users should update to 156.0.8078.88 on Windows and Mac. The rollout occurs gradually over coming days/weeks.

Repetiram sem novidade