Chrome 157 Fixes 213 Vulnerabilities, Seven Critical

Google has promoted Chrome 157 to its stable channel with security fixes for 213 vulnerabilities. The update is rolling out worldwide as versions 157.0.8103.38 and 157.0.8103.39 for Windows and macOS, and version 157.0.8103.38 for Linux.

The highest-rated flaw is a buffer overflow in Dawn, Google’s open-source implementation of the WebGPU standard. Google paid the researcher who reported it a $10,000 bug bounty.

The second critical flaw is a memory corruption issue in ANGLE, an open-source graphics layer that helps applications work with different graphics systems. Its reporter received $1,000.

The other five critical vulnerabilities include four use-after-free flaws and another buffer overflow. Google reported two of them, Anthropic researcher Xinyang Ge reported two and researcher Wenbin Liu reported one. Google did not list rewards for these reports.

Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. Google disclosed two related payouts: $10,000 for an incorrect-authorization flaw and $2,000 for an out-of-bounds read.

According to Google’s advisory, the company paid $31,000 in rewards for vulnerabilities fixed in the release. Bounties for 39 other flaws had not been determined when the advisory was published.

The patched issues include 51 cases involving incorrect or missing authorization, 45 use-after-free flaws, 19 cases of misleading user-interface behavior and 13 type-confusion bugs. The update also fixes 13 information-leak vulnerabilities, 11 out-of-bounds read or write issues, nine input-validation flaws and nine cases involving uninitialized resources.

Google did not report that any of the vulnerabilities had been exploited in attacks. Users can update Chrome through its built-in update process or download the latest version from Google.