Chrome 156 Security Update Fixes 21 Flaws, Including a Critical MediaStream Bug

TL;DR

Google has released Chrome 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux. This Chrome 156 security update fixes 21 vulnerabilities, including one critical Chrome vulnerability in MediaStream. The rollout covers both the Stable and Extended Stable channels.

The release patches 1 critical, 19 high and 1 medium severity flaw. Google has not reported any exploitation. Update Chrome and restart the browser to apply the fixes.

Notable CVEs

Why It Matters

This is the second Chrome 156 security update in a week, following an earlier release that fixed 52 flaws. In addition, 16 of the 21 new fixes are memory corruption or use-after-free bugs. These bug classes often serve as the first step in browser attacks.

How the Attack Works

Critical Chrome vulnerability

CVE-2026-76024 is a memory corruption flaw in MediaStream, reported by Xinyang Ge. According to its CVE record, it lets a remote attacker “potentially read memory inside the sandbox via a crafted HTML page.”

High severity flaws

The high-rated bugs span FileSystem, Autofill, Network, V8, Skia, Dawn, DOM and Blink. For example, CVE-2026-119262 in V8 could let attackers “execute arbitrary code inside the sandbox.” Google found 12 of the 21 issues itself, while Xinyang Ge reported four, including the critical Chrome vulnerability.

Affected Versions

All Chrome versions before 156.0.8078.79 are affected on Windows, Mac and Linux.

Patch and Mitigation

Open the Chrome menu, then go to Help and About Google Chrome to install the update. Google says, “Access to bug details and links may be kept restricted until a majority of users are updated with a fix.”

So far, no exploitation or public proof-of-concept has been confirmed. Nonetheless, apply this Chrome 156 security update soon.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.