Chrome Patches 83 Vulnerabilities, 5 Critical, Second Update in Two Days After Zero

Google on November 11, 2026 (U.S. time) updated the Stable channel of its Chrome web browser to versions 157.0.8103.78/.79 (Windows and Mac) and 157.0.8103.78 (Linux). The update includes 83 security fixes, among them five vulnerabilities classified as Critical, the highest severity level. The company disclosed the details on its official "Chrome Releases" blog. The updated versions will roll out gradually over the coming days to weeks.

All five Critical-rated flaws are of a type known as "Use After Free," in which memory that has already been freed is still referenced. The affected components span ServiceWorker (CVE-2026-126885), CSS (CVE-2026-126895), Layout (CVE-2026-126879), Skia (CVE-2026-126846) and Accessibility (CVE-2026-126911). The remaining 78 are rated High, the second-highest level. The official blog also lists items such as "Type Confusion" in the JavaScript engine V8 and "Buffer Overflow" (writing beyond buffer boundaries) in the rendering library Skia.

In the blog, Google noted that access to detailed information about the flaws may be restricted until a majority of users have received the fixed version. It said it will maintain such restrictions when similar problems exist in third-party libraries and other projects have not yet completed their fixes. It also expressed gratitude to the researchers who helped report the vulnerabilities.

The update is the second this week for Chrome 157. On November 9, Google disclosed that exploit code for a vulnerability tied to XML processing, "CVE-2026-125350," was circulating in the wild, and it released version 157.0.8103.50/.51 fixing nine vulnerabilities, including that one. Further back, on November 3, the first release of Chrome 157 was published with 213 fixes. The result is three updates in just over a week. For the current batch of 83, the official blog did not mention any exploitation.

Release date (U.S. time)VersionFixesMain detailsNovember 3Chrome 157 initial release213First release of Chrome 157November 9157.0.8103.50/.519Addressed XML processing vulnerability CVE-2026-125350; exploit code confirmedNovember 11157.0.8103.78/.7983Includes 5 Critical; no mention of exploitation

Note: Based on disclosures in Google's official "Chrome Releases" blog.

For the previously patched CVE-2026-125350, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it on November 10 to its list of vulnerabilities confirmed to have been exploited in the wild. The issue was reported by an anonymous researcher on November 6. An attacker could potentially execute malicious programs in a sandboxed area inside the browser by getting a user to open a specially crafted web page, though the specific attack method and scale of damage have not been disclosed.

On mobile, the Android version of Chrome 157 (157.0.8103.78) began rolling out on Google Play the same day. According to Google, the security fixes included in the Android version are identical to those in the desktop version.

Chrome normally downloads updates automatically, but fixes may not take effect unless the browser is restarted. Users are advised to open "Help" then "About Google Chrome" from the menu in the upper-right corner of the screen, check the version, and restart if the update has completed. On Linux, updates are delivered through the package manager. Because distribution proceeds in stages, users who have not yet received the fixed version should check again after some time.

The string of updates underscores once again that, with browsers serving as the foundation of daily work for companies and individuals, delays in applying patches can directly turn users into attack targets. Use After Free in particular is known as a category in which an attack can succeed simply by getting a user to view a crafted page, and it has been incorporated into targeted attacks in the past. The fact that a large-scale round of fixes was needed again immediately after a zero-day patch suggests that defects accompanying code changes in the Chrome 157 line may be surfacing in concentrated fashion over a short period. For administrators, this is a moment that calls for operations that track each device's version through asset management tools and prompt users to restart.