Chrome patches 83 security bugs, and MongoDB’s Node.js driver fixes a Critical redirect flaw

Google’s Chrome 157.0.8103.78 update fixes 83 security bugs, and MongoDB’s Node.js driver 7.8.0 fixes CVE-2026-126837, a flaw MongoDB itself scores 9.1 out of 10. The vulnerability feed cve.now posted about both on 14 November.

Its Chrome post is headed “CRITICAL” and counts 11 CVEs, with a worst score of 9.6 for a use-after-free bug in the Passwords component. Its second post flags the MongoDB flaw as CRITICAL 9.1.

🔴 CRITICAL · Google Chrome: 11 new CVEs

Worst (9.6): remote code execution via use-after-free in Passwords (CVE-2026-126909)

👉 Fix: 157.0.8103.78

— cve.now (@cvedotnow) November 14, 2026

Chrome: 83 fixes, five of them Critical

Google’s Chrome Releases post, dated 11 November, lists 83 fixes: five rated Critical and 78 rated High. The build is 157.0.8103.78 or .79 on Windows and Mac and 157.0.8103.78 on Linux, rolling out over days and weeks. Android gets 157.0.8103.78 through Google Play. Extended Stable users get 156.0.8078.100.

All five Critical bugs are use-after-free errors, where the browser keeps using memory after handing it back. They sit in ServiceWorker, CSS, Layout, Skia (the graphics library) and Accessibility. Of the High bugs, V8, the JavaScript engine, and Skia account for 17 each.

Google’s post doesn’t mark any of the 83 as exploited. A separate update on 9 November, 157.0.8103.50, fixed CVE-2026-125350, a bug Google said had an exploit.

The credits include AI-assisted finds. Anthropic’s Xinyang Ge and Vlad Stolyarov are credited, assisted by Claude, on CVE-2026-126886, CVE-2026-126887 and CVE-2026-126910, and Google credits OpenAI Codex Security for the V8 integer overflow CVE-2026-126916.

The Passwords bug and its two ratings

CVE-2026-126909 is a use-after-free in Passwords, reported by JonathanBouman on 11 October. The CVE record says a remote attacker “leveraging social engineering” could run code outside the sandbox through a crafted HTML page. Chromium rates it High, and Google hasn’t listed a bounty yet.

The 9.6 in cve.now’s post isn’t Google’s number. It’s the CVSS 3.1 score added by CISA, the US cyber agency, with a vector that needs a user to act. The National Vulnerability Database hasn’t scored the bug itself yet.

MongoDB: a forged DNS answer sends the driver elsewhere

MongoDB published CVE-2026-126837 on 12 November as the CVE’s own issuer. It covers the Node.js driver from 3.3.3 up to, but not including, 7.8.0, and only for mongodb+srv:// connection strings. The record says mongodb:// strings aren’t affected.

With an SRV string, the driver asks DNS for the database hosts and checks each name against the domain in the string. MongoDB’s record says it then builds the connection address from the original name, where certain characters end the host name early. Someone who can forge or change the DNS answer can pass the check and send the connection to a host they choose, exposing credentials and application data and altering query results. The record says TLS doesn’t stop it, because the driver checks the certificate against the redirected host.

MongoDB scores it 9.1 Critical on CVSS 4.0 and 7.4 High on CVSS 3.1. cve.now’s entry lists it as not in CISA’s Known Exploited Vulnerabilities catalogue and links one public proof-of-concept repository on GitHub.

🔴 CRITICAL 9.1 · MongoDB Node.js Driver: connection redirect via crafted SRV hostname (CVE-2026-126837)

An attacker who can forge DNS responses can redirect database traffic to their own host, exposing credentials.

👉 Fix: 7.8.0

— cve.now (@cvedotnow) November 14, 2026

What to update

The fix shipped before the CVE did. Driver 7.8.0 came out on 30 October, and its release notes already warned that SRV lookups weren’t verifying host names properly. The release normalises SRV host names and adds two settings, srvAllowedHostsSuffix and srvHostValidator, for tighter checks. It also makes timeoutMS a no-op, because of a separate bug, CVE-2026-119179, where a timed-out operation could expose another user’s data.

1. In Chrome, open Settings, then About Chrome, let it download 157.0.8103.78 or later and click Relaunch. Edge, Brave and other Chromium browsers ship their own matching updates.
2. In a Node.js project, run npm ls mongodb --all and upgrade any copy of the driver below 7.8.0. Mongoose wraps the same driver, so check the version it pulls in.
3. If you can’t upgrade yet, switch to a mongodb:// connection string, which the CVE record says isn’t affected.

Both CVE records were published by their vendors. The National Vulnerability Database hasn’t finished analysing either one.