Google fixes five critical use-after-free flaws in Chrome

Google has released Chrome 157.0.8103.78 for Windows and macOS (and 157.0.8103.78 for Linux), addressing a large set of security fixes in a single stable-channel update. The firm says the release patches 83 vulnerabilities, including five Critical use-after-free flaws spanning ServiceWorker, CSS, Layout, Skia and Accessibility components.

The affected CVEs publicly linked to these critical issues are CVE-2026-126885 (ServiceWorker), CVE-2026-126895 (CSS), CVE-2026-126879 (Layout), CVE-2026-126846 (Skia) and CVE-2026-126911 (Accessibility). Google notes that there were no reported exploits in the wild for these particular fixes at the time of disclosure, and emphasises that the patch includes many High-severity bugs across multiple subsystems, such as V8, ANGLE and the Media pipeline.

The article lists a total of eight CVEs addressed in this update, with several High-severity issues clustered in the V8 JavaScript engine and the Skia graphics library, among others. It also records that one V8 use-after-free (CVE-2026-126864) attracted a disclosed bounty of $4,000 to researcher Jihyeon Jeong. Chrome’s patch notes indicate affected versions as Chrome for Windows and Mac prior to 157.0.8103.78/79 and Chrome for Linux prior to 157.0.8103.78.

Deployment is described as a staged rollout spanning “days/weeks,” so users are advised to update promptly and relaunch the browser; users of other Chromium-based browsers should apply the corresponding update when available. The article attributes these findings to Google and several researchers, with ongoing private disclosure for some details.