Extended Stable Update for Desktop

Wednesday, November 11, 2026

The Extended Stable channel has been updated to 156.0.8078.100 for Windows and Mac which will roll out over the coming days/weeks.

Security Fixes

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 72 security fixes. Please see the Chrome Security Page for more information.

[576736463] Critical CVE-2026-126879
[568699166] Critical CVE-2026-126885
[575524700] Critical CVE-2026-126895
[580921803] Critical CVE-2026-126911

[578664961] High CVE-2026-126840

[580865537] High CVE-2026-126841

[574209539] High CVE-2026-126842

[578322433] High CVE-2026-126843

[576944655] High CVE-2026-126844

[572988453] High CVE-2026-126847

[578685477] High CVE-2026-126848

[579313193] High CVE-2026-126849

[574792758] High CVE-2026-126851

[580846651] High CVE-2026-126852

[573263421] High CVE-2026-126853

[578655807] High CVE-2026-126854

[577260644] High CVE-2026-126856

[578656869] High CVE-2026-126857

[563340397] High CVE-2026-126859

[581785712] High CVE-2026-126860

[577171064] High CVE-2026-126861

[575312521] High CVE-2026-126863

[567827593] High CVE-2026-126864

[573335176] High CVE-2026-126865

[576943246] High CVE-2026-126866

[580867734] High CVE-2026-126868

[575533210] High CVE-2026-126869

[568906910] High CVE-2026-126870

[574218401] High CVE-2026-126871

[577376424] High CVE-2026-126872

[577336494] High CVE-2026-126873

[574222006] High CVE-2026-126875

[576664769] High CVE-2026-126876

[577377985] High CVE-2026-126877

[572312779] High CVE-2026-126878

[577366752] High CVE-2026-126880

[575038730] High CVE-2026-126881

[578659604] High CVE-2026-126883

[576949530] High CVE-2026-126884

[567611696] High CVE-2026-126886

[567611698] High CVE-2026-126887

[577461556] High CVE-2026-126888

[560620348] High CVE-2026-126889

[581629247] High CVE-2026-126890

[575939904] High CVE-2026-126891

[578656065] High CVE-2026-126892

[579278668] High CVE-2026-126893

[576950618] High CVE-2026-126894

[575524702] High CVE-2026-126896

[578656106] High CVE-2026-126897

[574216555] High CVE-2026-126898

[583122799] High CVE-2026-126899

[574409610] High CVE-2026-126900

[579818899] High CVE-2026-126901

[580867480] High CVE-2026-126902

[574410140] High CVE-2026-126904

[577305517] High CVE-2026-126905

[578693038] High CVE-2026-126906

[574791611] High CVE-2026-126907

[579313083] High CVE-2026-126908

[572501958] High CVE-2026-126909

[574059463] High CVE-2026-126910

[569286603] High CVE-2026-126912

[580875215] High CVE-2026-126913

[577346516] High CVE-2026-126914

[574025697] High CVE-2026-126916

[577242082] High CVE-2026-126917

[576855527] High CVE-2026-126918

[569674220] High CVE-2026-126919

[581903854] High CVE-2026-126920

[580869107] High CVE-2026-126921

[577341943] High CVE-2026-126922

A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

Stable Channel Update for Desktop

Wednesday, November 11, 2026

The Stable channel has been updated to 157.0.8103.78/.79 for Windows and Mac and 157.0.8103.78 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 83 security fixes. Please see the Chrome Security Page for more information.
[N/A][568699166] Critical CVE-2026-126885: Use after free in ServiceWorker. Reported by Xinyang Ge on 2026-10-02
[N/A][575524700] Critical CVE-2026-126895: Use after free in CSS. Reported by Xinyang Ge on 2026-10-19
[N/A][576736463] Critical CVE-2026-126879: Use after free in Layout. Reported by Xinyang Ge on 2026-10-22
[N/A][580857377] Critical CVE-2026-126846: Use after free in Skia. Reported by Google on 2026-11-02
[TBD][580921803] Critical CVE-2026-126911: Use after free in Accessibility. Reported by Andrew Boni on 2026-11-02
[$4,000][567827593] High CVE-2026-126864: Use after free in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-09-30
[N/A][560620348] High CVE-2026-126889: Off-by-one error in V8. Reported by Google on 2026-09-12
[N/A][563340397] High CVE-2026-126859: Link following in FileSystem. Reported by Google on 2026-09-18
[N/A][567611696] High CVE-2026-126886: Use after free in Frames. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][567611698] High CVE-2026-126887: Use after free in Animation. Reported by Xinyang Ge (Anthropic), assisted by Claude on 2026-09-29
[N/A][568906910] High CVE-2026-126870: Uninitialized resource in ANGLE. Reported by Google on 2026-10-02
[N/A][569286603] High CVE-2026-126912: Buffer overflow in Skia. Reported by Xinyang Ge on 2026-10-05
[N/A][569674220] High CVE-2026-126919: Use after free in BrowserTag. Reported by Xinyang Ge on 2026-10-05
[TBD][572312779] High CVE-2026-126878: Information leak in Core. Reported by Anthropic and Ada Logics on 2026-10-10
[TBD][572501958] High CVE-2026-126909: Use after free in Passwords. Reported by JonathanBouman on 2026-10-11
[TBD][572988453] High CVE-2026-126847: Type confusion in V8. Reported by Salvatore Gulizia (Serotav) on 2026-10-13
[N/A][573263421] High CVE-2026-126853: Uninitialized resource in Skia. Reported by Google on 2026-10-13
[TBD][573335176] High CVE-2026-126865: Use after free in DOM. Reported by Jinu Kim (@uz56764) of EUCLIDSOFT on 2026-10-14
[N/A][574025697] High CVE-2026-126916: Integer overflow in V8. Reported by OpenAI Codex Security (kylebot) on 2026-10-15
[TBD][574035865] High CVE-2026-126903: Improper state validation in ANGLE. Reported by arang on 2026-10-15
[N/A][574059463] High CVE-2026-126910: Type confusion in V8. Reported by Vlad Stolyarov (Anthropic), assisted by Claude on 2026-10-16
[N/A][574209539] High CVE-2026-126842: Use after free in ANGLE. Reported by Google on 2026-10-16
[N/A][574216555] High CVE-2026-126898: Uninitialized resource in Skia. Reported by Google on 2026-10-16
[N/A][574218401] High CVE-2026-126871: Out of bounds read in Skia. Reported by Google on 2026-10-16
[N/A][574222006] High CVE-2026-126875: Missing authorization in V8. Reported by Google on 2026-10-16
[N/A][574381704] High CVE-2026-126862: Improper input validation in Core. Reported by Google on 2026-10-16
[N/A][574409610] High CVE-2026-126900: Use after free in CSS. Reported by Google on 2026-10-16
[N/A][574410140] High CVE-2026-126904: Use after free in Compositing. Reported by Google on 2026-10-16
[N/A][574791611] High CVE-2026-126907: Uninitialized resource in Media. Reported by Google on 2026-10-17
[N/A][574792758] High CVE-2026-126851: Use after free in Accessibility. Reported by Google on 2026-10-17
[N/A][574795295] High CVE-2026-126845: Uninitialized resource in GPU. Reported by Google on 2026-10-17
[N/A][575038730] High CVE-2026-126881: Improper initialization in Media. Reported by Google on 2026-10-18
[N/A][575086736] High CVE-2026-126867: Use after free in Browser. Reported by Google on 2026-10-18
[N/A][575312521] High CVE-2026-126863: Use after free in HTML. Reported by Google on 2026-10-19
[N/A][575524702] High CVE-2026-126896: Missing authorization in V8. Reported by Xinyang Ge on 2026-10-19
[N/A][575533210] High CVE-2026-126869: Use after free in Frames. Reported by Xinyang Ge on 2026-10-19
[TBD][575937643] High CVE-2026-126858: Uninitialized resource in ANGLE. Reported by weihengqiuu on 2026-10-20
[N/A][575939904] High CVE-2026-126891: Use after free in V8. Reported by Vlad Stolyarov (Anthropic), assisted by Claude on 2026-10-20
[N/A][576439987] High CVE-2026-126874: Type confusion in V8. Reported by OpenAI Codex Security (kylebot) on 2026-10-22
[N/A][576664769] High CVE-2026-126876: Integer overflow in Skia. Reported by Google on 2026-10-22
[N/A][576855527] High CVE-2026-126918: Use after free in Layout. Reported by Xinyang Ge on 2026-10-23
[TBD][576943246] High CVE-2026-126866: Incorrect authorization in Extensions. Reported by @bean5oup on 2026-10-23
[N/A][576944655] High CVE-2026-126844: Uninitialized resource in Skia. Reported by Google on 2026-10-23
[N/A][576949530] High CVE-2026-126884: Out of bounds read in Skia. Reported by Google on 2026-10-23
[N/A][576950618] High CVE-2026-126894: Out of bounds read in Skia. Reported by Google on 2026-10-23
[TBD][577171064] High CVE-2026-126861: Use after free in Media. Reported by Alessandro Rizzo (0xAlessandro) on 2026-10-23
[N/A][577242082] High CVE-2026-126917: Memory corruption in V8. Reported by Google on 2026-10-24
[N/A][577260644] High CVE-2026-126856: Incomplete cleanup in Cache. Reported by Xinyang Ge (Anthropic) on 2026-10-24
[N/A][577305517] High CVE-2026-126905: Incomplete cleanup in V8. Reported by Google on 2026-10-24
[N/A][577336494] High CVE-2026-126873: Use after free in Extensions. Reported by Google on 2026-10-24
[N/A][577341943] High CVE-2026-126922: Out of bounds read in Skia. Reported by Google on 2026-10-24
[N/A][577346516] High CVE-2026-126914: Uninitialized resource in Skia. Reported by Google on 2026-10-24
[N/A][577366752] High CVE-2026-126880: Type confusion in V8. Reported by Xinyang Ge (Anthropic) on 2026-10-24
[N/A][577376424] High CVE-2026-126872: Incorrect authorization in FileSystem. Reported by Google on 2026-10-24
[N/A][577377985] High CVE-2026-126877: Use after free in Dawn. Reported by Google on 2026-10-24
[N/A][577461556] High CVE-2026-126888: Buffer overflow in Turbolev. Reported by OpenAI Codex Security (amyb) on 2026-10-25
[N/A][578322433] High CVE-2026-126843: Type confusion in Turbolev. Reported by Google on 2026-10-27
[N/A][578655807] High CVE-2026-126854: Incorrect authorization in Layout. Reported by Google on 2026-10-27
[N/A][578656065] High CVE-2026-126892: Use after free in MediaStream. Reported by Google on 2026-10-27
[N/A][578656106] High CVE-2026-126897: Type confusion in V8. Reported by Google on 2026-10-27
[N/A][578656869] High CVE-2026-126857: Out of bounds read in Skia. Reported by Google on 2026-10-27
[N/A][578659604] High CVE-2026-126883: Use after free in Core. Reported by Google on 2026-10-27
[N/A][578664961] High CVE-2026-126840: Out of bounds write in Network. Reported by Google on 2026-10-28
[N/A][578685477] High CVE-2026-126848: Uninitialized resource in Skia. Reported by Google on 2026-10-28
[N/A][578685706] High CVE-2026-126882: Information leak in Skia. Reported by Google on 2026-10-28
[N/A][578693038] High CVE-2026-126906: Race condition in Extensions. Reported by Google on 2026-10-28
[N/A][579276256] High CVE-2026-126915: Use of uninitialized variable in Skia. Reported by Google on 2026-10-29
[N/A][579278668] High CVE-2026-126893: Out of bounds write in V8. Reported by Google on 2026-10-29
[TBD][579300424] High CVE-2026-126855: Missing authorization in ImageCapture. Reported by z3r0 on 2026-10-29
[N/A][579313083] High CVE-2026-126908: Type confusion in V8. Reported by Google on 2026-10-29
[N/A][579313193] High CVE-2026-126849: Type confusion in V8. Reported by Google on 2026-10-29
[N/A][579818899] High CVE-2026-126901: Use after free in PDF. Reported by Vlad Stolyarov (Anthropic), assisted by Claude on 2026-10-30
[N/A][580846651] High CVE-2026-126852: Use after free in MediaStream. Reported by Google on 2026-11-02
[N/A][580853808] High CVE-2026-126850: Incorrect authorization in SiteIsolation. Reported by Google on 2026-11-02
[N/A][580865537] High CVE-2026-126841: Out of bounds read in Skia. Reported by Google on 2026-11-02
[N/A][580867480] High CVE-2026-126902: Incorrect reference resolution in Browser. Reported by Google on 2026-11-02
[N/A][580867734] High CVE-2026-126868: Type confusion in V8. Reported by Google on 2026-11-02
[N/A][580869107] High CVE-2026-126921: Use after free in Accessibility. Reported by Google on 2026-11-02
[N/A][580875215] High CVE-2026-126913: Out of bounds read in Compositing. Reported by Google on 2026-11-02
[TBD][581629247] High CVE-2026-126890: Out of bounds read in Media. Reported by Vikas Anil Sharma - ( Agilehunt.com - Guarding your innovation ) on 2026-11-04
[TBD][581785712] High CVE-2026-126860: Incorrect authorization in FileSystem. Reported by tmemabo1 on 2026-11-04
[N/A][581903854] High CVE-2026-126920: Information leak in Skia. Reported by Google on 2026-11-04
[N/A][583122799] High CVE-2026-126899: Use after free in Elements. Reported by Google on 2026-11-07
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Srinivas Sista

Google Chrome

Chrome Releases

Extended Stable Update for Desktop

Stable Channel Update for Desktop

Labels

Archive