Google has promoted Chrome 157 to the stable channel with fixes for 213 vulnerabilities, seven of them rated critical. None of the flaws are known to be exploited in the wild, which makes this an update to complete early rather than an emergency.
What happened
The critical items are memory safety bugs. The most serious is a buffer overflow in Dawn, the cross-platform implementation of the WebGPU standard, which earned its reporter a $10,000 reward. The second is memory corruption in ANGLE, the graphics abstraction layer. The remaining five are four use-after-free defects and a buffer overflow.
The release also fixes 77 high-severity issues. By bug class the largest groups are incorrect or missing authorization (51), use-after-free (45) and UI misrepresentation (19). Google published $31,000 in rewards for this release and has not yet set bounties on 39 of the flaws it fixed.
Who is affected
Any organisation running Chrome on managed desktops, laptops or terminal servers.
- Chrome on Windows and macOS before 157.0.8103.38/.39
- Chrome on Linux before 157.0.8103.38
- Estates that pin browser versions or delay updates for application compatibility
What to do now
Get Chrome 157 onto every managed endpoint this week and confirm the installed version from your inventory, not from user reports. The update is rolling out automatically; the real work is the machines that never restart and the ones excluded from update policy.
- Query your management tool for anything still on Chrome 156 or earlier and force the update
- Restart the browser, not only the machine, because the new build applies to fresh processes
- Check terminal servers, kiosks and shared workstations, which are usually the last to receive browser updates
What this means for South African businesses
Critical memory bugs in the graphics and WebGPU layers are the class of flaw that gets chained with a hostile web page, and a typical South African office of 40 people has dozens of Chrome installs with no browser version reporting at all. The practical risk is not a zero-day against a targeted firm; it is a laptop sitting months behind because nobody owns the browser. If your team cannot answer what Chrome version is on a given machine in one query, fix that visibility gap before the next release lands.
Source: Chrome 157 rolls out with 213 security fixes on SecurityWeek.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.