Google Chrome 157 fixes 213 vulnerabilities, including seven critical memory-safety flaws in Dawn, ANGLE and WebGL
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 13/11/2026 00:06; os links antigos trazem para cá.
Fontes: cert.cyber.gouv.fr ×2 ↗ gbhackers.com ↗ malwarebytes.com ↗ securityweek.com ↗ securityonline.info ↗
Google released Chrome 157 (157.0.8103.38/.39) to the stable channel on 3 November 2026, fixing 213 security issues, an unusually large batch for one release. Seven are rated critical memory-safety bugs: buffer overflows in Dawn (WebGPU), memory corruption in ANGLE and four use-after-free defects (securityonline.info, securityweek.com, gbhackers.com). Google has not reported in-the-wild exploitation of any of the fixes (securityweek.com, securityonline.info, gbhackers.com), and the CERT-FR bulletin does not mention exploitation either (cert.cyber.gouv.fr). Critical browser bugs of this kind could let a malicious web page escape the sandbox and execute arbitrary code (securityonline.info). AI-assisted research played a large part: Anthropic (Xinyang Ge, aided by Claude) and OpenAI Codex Security were credited for 17 of the bugs combined (securityonline.info, gbhackers.com). The full severity breakdown is seven critical, 77 high, 75 medium and 54 low-severity vulnerabilities, matching Google's stated total of 213 fixes (gbhackers.com). CERT-FR relayed the update in bulletin CERTFR-2026-AVI-1450 (cert.cyber.gouv.fr). On 12 November 2026 CERT-FR also published a separate notice on Microsoft Edge versions before 157.0.4341.42, affected by multiple unspecified vulnerabilities, with Microsoft bulletins issued on 5 November 2026 (cert.cyber.gouv.fr). Users should update promptly.
Entenda a falha
A vulnerabilidade
Chrome 157 fixes 213 security issues: 7 critical, 77 high, 75 medium and 54 low. The most severe is CVE-2026-121156 (CVSS 9.6), a buffer overflow in Dawn, Chrome's WebGPU engine. Next come CVE-2026-121247 (another Dawn buffer overflow), CVE-2026-121229 (memory corruption in ANGLE) and four use-after-free bugs: CVE-2026-121246 (WebGL), CVE-2026-121035 (Prerender), CVE-2026-121203 (Geometry) and CVE-2026-121126 (Core). Malwarebytes says a crafted HTML page could let a remote attacker run code outside the sandbox via the ANGLE flaw. Google gives no detailed prerequisites. Desktop builds before 157.0.8103.38 are affected (Windows and Mac get 157.0.8103.38/.39); Extended Stable is fixed in 156.0.8078.88. Microsoft Edge before 157.0.4341.42 is also affected by unspecified CVEs, and the articles do not say which ones match the Chrome fixes. The other 200-plus CVEs are only mentioned in passing.
Como funciona
The articles describe the flow only in general terms. A web page, such as a crafted HTML page, reaches Chrome's graphics and rendering code. Dawn translates WebGPU instructions into commands the device's graphics system understands, and ANGLE is the graphics translation layer. Prerender loads and renders a page in the background and runs its JavaScript before the user navigates to it. In the overflow bugs, data is written past the end of a memory block. In the use-after-free bugs, code keeps using memory after the browser has released it. At that point memory is corrupted, which can cause a crash or, in the worst case, let an attacker run code. Google does not publish per-bug details.
Por que é vulnerável
The seven critical bugs are memory-safety defects: writing past the bounds of a buffer (Dawn, ANGLE) and using memory after it was freed (WebGL, Prerender, Geometry, Core). The articles give no deeper root cause for individual CVEs and do not explain why they went unnoticed or what each patch changes. Google keeps bug details restricted until most users have updated, and sometimes longer when third-party libraries need coordinated fixes. GBHackers notes that component overlap with earlier Dawn and WebGL fixes does not show a shared root cause.
Onde está
The articles name only components (Dawn, ANGLE, WebGL, Prerender, Geometry, Core), not files, functions or commits.
Como foi descoberta
Google announced the release on 3 November 2026 and reports no exploitation in the wild. Google's internal teams found 38 of the 84 critical and high bugs. AI-assisted research was prominent: Anthropic researchers assisted by Claude are credited with 12 bugs and OpenAI Codex Security with five more (securityonline.info). Xinyang Ge of Anthropic, with Claude, found the Prerender flaw CVE-2026-121035. According to GBHackers, Zhenpeng "Leo" Lin of depthfirst received $10,000 for CVE-2026-121156 and researcher @mfx $1,000 for CVE-2026-121229. SecurityWeek credits Wenbin Liu with one critical bug. Rewards paid total $31,000, with 39 still undetermined. For Edge, Microsoft published bulletins on 5 November and CERT-FR a notice on 12 November; the articles do not say how those flaws were found.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:21.
Detalhes técnicos
- CVE-2026-121156 (CVSS 9.6) and CVE-2026-121247: buffer overflows in Dawn (WebGPU) (securityonline.info).
- CVE-2026-121229: memory corruption in ANGLE (securityonline.info).
- CVE-2026-121246: use-after-free in WebGL (securityonline.info).
- CVE-2026-121035: use-after-free in Prerender, found by Xinyang Ge of Anthropic with Claude (securityonline.info, gbhackers.com).
- CVE-2026-121203: use-after-free in Geometry (securityonline.info).
- CVE-2026-121126: use-after-free in Core (securityonline.info).
- Besides the seven critical flaws, 77 are high severity (securityweek.com, gbhackers.com). V8 has 10 high-severity type confusion flaws, and other fixes affect PDFium, Skia, Media and FileSystem (securityonline.info). High-severity fixes also include authorization weaknesses in BackgroundFetch and FileSystem, and use-after-free defects across rendering and interface components (gbhackers.com).
- Bug classes (securityweek.com): incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), uninitialized resource (9).
- Google's internal teams found 38 of the 84 critical/high bugs (securityonline.info), including several of the critical flaws (securityweek.com). Other credited reporters include Wenbin Liu (securityweek.com, gbhackers.com).
- Bug bounty: $31,000 paid so far, with payouts for 39 flaws still undetermined (securityweek.com). Top rewards of $10,000 went to the Dawn overflow and a BackgroundFetch authorization issue (securityonline.info). GBHackers identifies the $10,000 Dawn reward as paid to Zhenpeng "Leo" Lin at depthfirst for CVE-2026-121156, and a $1,000 reward to researcher @mfx for CVE-2026-121229 (gbhackers.com).
- CERT-FR bulletin CERTFR-2026-AVI-1450 covers a very large batch of CVEs starting from CVE-2026-121029 (the list in the provided text is truncated). It describes the impact only as a "security issue not specified by the vendor", gives no severity or CVSS scores, and lists Chrome versions before 157.0.8103.38 on Linux, Windows and Mac as affected (cert.cyber.gouv.fr).
- Microsoft Edge: a CERT-FR notice dated 12 November 2026 reports multiple unspecified security vulnerabilities in Edge versions prior to 157.0.4341.42. Microsoft does not detail their specifics, scope or exact impact, and published security bulletins on 5 November 2026 covering numerous CVEs (cert.cyber.gouv.fr). The input does not say which of these CVEs, if any, match the Chrome 157 fixes.
Remediação
Update to Chrome 157.0.8103.38 on Linux or 157.0.8103.38/.39 on Windows and macOS via Settings > About Chrome, then restart the browser (securityonline.info, securityweek.com, gbhackers.com). CERT-FR likewise advises updating to 157.0.8103.38 or later on all platforms, restarting the browser, and consulting Google's bulletin for the fixes (cert.cyber.gouv.fr). Extended Stable users should update to 156.0.8078.88 on Windows and Mac (securityonline.info). The rollout is gradual over the coming days or weeks (securityonline.info, gbhackers.com). Microsoft Edge users should update to the fixed version (157.0.4341.42 or later) and consult the Microsoft Edge security bulletins (cert.cyber.gouv.fr).
Relatos divergentes
- Use-after-free count: securityonline.info reports 35 use-after-free issues, while securityweek.com reports 45. The sources do not explain the difference, and securityweek.com is the more recent. Neither figure is vendor-confirmed in the input.
- Fixed version wording: cert.cyber.gouv.fr gives 157.0.8103.38 as the fixed threshold for Linux, Windows and Mac, while securityonline.info, securityweek.com and gbhackers.com cite 157.0.8103.38/.39 for Windows and macOS. This is likely a difference in how the builds are described rather than a real disagreement; cert.cyber.gouv.fr is the most recent source.
Linha do tempo
-
Multiple unspecified security vulnerabilities patched in Microsoft Edge before 157.0.4341.42
ler a análise desta fonte ocultar
Multiple unspecified security vulnerabilities have been discovered in Microsoft Edge versions prior to 157.0.4341.42. These vulnerabilities could allow an attacker to cause various security issues, though specifics are not detailed by the vendor. Microsoft has released security bulletins on November 5, 2026, addressing numerous CVEs related to these flaws. Users are strongly advised to consult the official Microsoft Edge security bulletins and update their browsers to the fixed versions to mitigate potential risks. The scope and exact impact of these vulnerabilities remain unspecified by Microsoft.
-
CERT-FR flags multiple vulnerabilities in Google Chrome before 157.0.8103.38 (hundreds of CVEs, November 2026 stable update)
ler a análise desta fonte ocultar
The CERT-FR bulletin CERTFR-2026-AVI-1450 relays the Google Chrome stable channel update of 3 November 2026. It covers a very large batch of CVEs, from CVE-2026-121029 onward. The list in the provided text is truncated. The bulletin says the flaws let an attacker cause a "security issue not specified by the vendor". It does not give severity, impact or CVSS scores. Affected products are Chrome versions before 157.0.8103.38 on Linux, Windows and Mac. The bulletin tells readers to consult Google's bulletin for the fixes. It does not mention exploitation.
Remediation
Update Chrome to 157.0.8103.38 or later on all platforms. Restart the browser so the update applies.
-
Google Chrome 157 Patches 213 Flaws, Including Seven Critical Memory-Safety Bugs in Dawn, ANGLE and WebGL
This article adds specific bug bounty attribution: $10,000 paid to Zhenpeng "Leo" Lin at depthfirst for CVE-2026-121156 (the Dawn buffer overflow) and $1,000 to researcher @mfx for CVE-2026-121229 (the ANGLE memory corruption), details not previously captured in the case report. It also confirms the severity breakdown of 7 critical, 77 high, 75 medium and 54 low vulnerabilities, consistent with but more granular on the medium/low counts than prior sources.
ler a análise desta fonte ocultar
This article adds specific bug bounty attribution: $10,000 paid to Zhenpeng "Leo" Lin at depthfirst for CVE-2026-121156 (the Dawn buffer overflow) and $1,000 to researcher @mfx for CVE-2026-121229 (the ANGLE memory corruption), details not previously captured in the case report. It also confirms the severity breakdown of 7 critical, 77 high, 75 medium and 54 low vulnerabilities, consistent with but more granular on the medium/low counts than prior sources.
Google shipped Chrome 157 (157.0.8103.38/.39) fixing 213 security issues, seven rated critical: two buffer overflows in Dawn, memory corruption in ANGLE, and four use-after-free bugs in WebGL, Prerender, Geometry and Core. Google has not disclosed exploitation prerequisites and does not state any flaw is actively exploited in the wild. AI-assisted research again featured prominently, with Anthropic's Xinyang Ge (aided by Claude) and OpenAI Codex Security credited for several reports. Bug bounty payouts included $10,000 to Zhenpeng "Leo" Lin at depthfirst for the Dawn overflow (CVE-2026-121156) and $1,000 to researcher @mfx for the ANGLE flaw (CVE-2026-121229).
Technical Details
The disclosed severity breakdown is seven critical, 77 high, 75 medium and 54 low, matching Google's total of 213 fixes. High-severity issues include V8 type confusion, PDFium memory-safety flaws, and authorization weaknesses in BackgroundFetch and FileSystem, alongside use-after-free defects across rendering and interface components.
Remediation
Users should verify Chrome has updated via Help > About Google Chrome and relaunch the browser; administrators should prioritize deployment across managed endpoints since rollout is gradual over coming days and weeks.
-
Chrome 157 Patches 213 Vulnerabilities, Seven Critical Memory Safety Flaws
ler a análise desta fonte ocultar
Google released Chrome 157 to the stable channel, fixing 213 vulnerabilities including seven critical memory safety bugs. The most severe issues involve a buffer overflow in Dawn (the WebGPU implementation) and a memory corruption flaw in ANGLE, alongside four use-after-free defects and another buffer overflow. Google paid out $31,000 in bug bounty rewards so far, with payouts for 39 flaws still undetermined. No in-the-wild exploitation has been observed for any of the patched issues, but users are urged to update promptly given the volume and severity of fixes.
Technical Details
The update addresses 77 high-severity vulnerabilities in addition to the seven critical ones. Common bug classes include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9). Reporters credited include Anthropic's Xinyang Ge and researcher Wenbin Liu, among others; Google itself discovered several of the critical flaws.
Remediation
Chrome 157 is rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and 157.0.8103.38 for Linux. Users should update their browsers as soon as the new version becomes available.
-
Chrome 157 Patches 213 Flaws, Including 7 Critical Memory Corruption Bugs
ler a análise desta fonte ocultar
Google has released Chrome 157 (157.0.8103.38/.39) to the stable channel, fixing 213 security issues, an unusually large batch for a single release. Seven flaws are rated critical, including buffer overflows in the Dawn WebGPU engine and memory corruption in ANGLE, along with multiple use-after-free bugs in WebGL, Prerender, Geometry and Core. Google has not confirmed exploitation in the wild for any of these issues, but critical browser bugs could allow a malicious web page to escape sandboxing and execute arbitrary code. AI-assisted research played a significant role this cycle, with Anthropic (aided by Claude) and OpenAI Codex Security credited for 17 of the reported bugs combined.
Technical Details
- CVE-2026-121156 (CVSS 9.6) and CVE-2026-121247: buffer overflows in Dawn (WebGPU)
- CVE-2026-121229: memory corruption in ANGLE
- CVE-2026-121246: use-after-free in WebGL
- CVE-2026-121035: use-after-free in Prerender (found by Xinyang Ge of Anthropic with Claude)
- CVE-2026-121203: use-after-free in Geometry
- CVE-2026-121126: use-after-free in Core
- Use-after-free bugs account for 35 of the listed issues; V8 has 10 high-severity type confusion flaws; other fixes affect PDFium, Skia, Media and FileSystem.
- Google's internal teams found 38 of the 84 critical/high severity bugs; top bug bounty rewards were $10,000 for the Dawn overflow and a BackgroundFetch authorization issue.
Remediation
Update to Chrome 157.0.8103.38 (Linux) or 157.0.8103.38/.39 (Windows/Mac) via Settings > About Chrome, then restart the browser. Extended Stable channel users should update to 156.0.8078.88 on Windows and Mac. The rollout occurs gradually over coming days/weeks.