Google has released a large security update for its Chrome browser, fixing 83 vulnerabilities in a single Stable channel release. The update, published on 11 November, takes Chrome on Windows and Mac to version 157.0.8103.78 or 157.0.8103.79, and Chrome on Linux to 157.0.8103.78. It is one of the biggest single batches of fixes Google has shipped for the browser, and users should install it and restart the browser to be covered.

The sheer size of the release stands out. Routine Chrome updates usually carry a handful of security fixes; this one repairs dozens of flaws across the browser's core components, from its JavaScript engine to its graphics library. Google has not reported any exploitation of the flaws in this batch, but the company is keeping technical details restricted until most users have updated, which is its standard practice when a fix could help attackers build an exploit.

Five critical memory flaws lead the fixes

Five of the 83 flaws are rated Critical by Google, and all five are use-after-free errors, a class of memory bug in which software keeps using a piece of memory after it has been freed. An attacker who can control that freed memory may be able to run code through a crafted web page, and in some cases such flaws can help an attacker escape the browser sandbox.

The critical flaws are CVE-2026-126885, a use-after-free bug in ServiceWorker; CVE-2026-126895, in the CSS engine; CVE-2026-126879, in the page layout code; CVE-2026-126846, in the Skia graphics library; and CVE-2026-126911, in the Accessibility component. Each is fixed by the 157.0.8103.78 update.

Google lists no exploits in the wild for any of the flaws in this release. That contrasts with the previous Chrome update, issued on 10 November, which fixed CVE-2026-125350, a use-after-free flaw in Chrome's XML component that attackers were already exploiting. That earlier flaw was the eighth actively exploited Chrome zero-day patched by Google in 2026.

Most fixes sit in a handful of components

The remaining 78 flaws are rated High severity, and they cluster in a small number of components. Seventeen fixes target the V8 JavaScript engine, including type confusion bugs such as CVE-2026-126910, while another 17 target the Skia graphics library. The ANGLE graphics layer, Media, Extensions and FileSystem components also received several fixes each.

One researcher, Jihyeon Jeong, earned the only disclosed bounty in the release, 4,000 dollars, for reporting the V8 use-after-free flaw CVE-2026-126864. Security reporting on the release also notes that several of the flaws were found by researchers working with AI tools, including researchers at Anthropic assisted by Claude and OpenAI's Codex Security team, while Google's own teams found most of the remaining bugs.

How to update

To install the update, open Chrome's Settings, then About Chrome, and let the update download. Click Relaunch to apply it. Google says the rollout will take days or weeks to reach every user automatically, so checking manually is the faster route.

Users of Edge, Brave and other Chromium-based browsers should apply their own vendor's matching update when it ships, since those browsers share much of Chrome's code and are affected by many of the same flaws.