Chrome 156 Ships With 353 Security Fixes, Including Six Critical Vulnerabilities

TL;DR

Google promoted Chrome 156 to the stable channel on October 20, 2026, with 353 security fixes. The Chrome 156 security update patches six critical vulnerabilities in Skia, Accessibility, CSS, Paint and WebRTC. Google reports no exploitation in the wild.

Notable CVEs

Why It Matters

353 fixes is an unusually large haul for one browser release. Most of the listed bugs are memory corruption or use-after-free flaws. In general, these bugs can let a malicious web page crash the browser or run code inside it.

For comparison, the Chrome 155 stable release fixed 37 security issues. That makes the Chrome 156 security update roughly ten times larger. Google’s own internal teams found many of the bugs, but outside researchers and AI tools also played a big part this cycle.

AI-assisted bug hunting stands out

Notably, AI tools helped find several of the worst bugs. Xinyang Ge reported four of the six critical vulnerabilities. Google credits one of them, CVE-2026-113271, to Ge (Anthropic), “assisted by Claude.” Meanwhile, OpenAI Codex Security reported the critical WebRTC flaw, CVE-2026-113303, plus two high-severity V8 bugs.

How the Attacks Work

The six critical vulnerabilities

• CVE-2026-113341: memory corruption in Skia, Chrome’s graphics library
• CVE-2026-113279: memory corruption in Accessibility
• CVE-2026-113271: use after free in Accessibility
• CVE-2026-113072: memory corruption in CSS
• CVE-2026-113280: memory corruption in Paint
• CVE-2026-113303: memory corruption in WebRTC

Typically, an attacker would lure a victim to a crafted web page to trigger bugs like these. Google has not shared technical details. As usual, it keeps bug reports private “until a majority of users are updated with a fix.”

High-severity fixes

The release lists 61 high-severity flaws. They span V8, ANGLE, WebGL, PDF, Navigation and the new Turbolev compiler. ANGLE, the graphics translation layer, alone accounts for more than a dozen of them.

Bug bounties

The largest disclosed reward is $10,000. Quyen Son of VinFast earned it for CVE-2026-113101, a use-after-free in Site Isolation. Several other rewards are still to be decided.

Exploitation status

Google has not flagged any flaw as exploited. None appear in CISA’s KEV catalog.

Affected Versions

Chrome desktop versions before 156.0.8078.47 on Windows, Mac and Linux are affected.

Patch and Mitigation Steps

• Update to 156.0.8078.47/.48 on Windows and Mac, or 156.0.8078.47 on Linux.
• Open Settings, then About Chrome, and relaunch the browser.
• Watch for matching updates in Edge, Brave and other Chromium browsers.

The Chrome 156 stable channel release will roll out over days or weeks. With six critical vulnerabilities fixed, users should apply this Chrome 156 security update manually now.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.