Chrome 156 patches 353 flaws, six of them critical
Original title: Google Releases Massive Chrome Security Update Fixing 353 Flaws, Including 6 Critical Vulnerabilities
Fixed builds are 156.0.8078.47 on Linux and 156.0.8078.47 or .48 on Windows and Mac; Google does not report active attacks.
Google released Chrome 156 for Windows, macOS, and Linux on October 20, 2026, fixing 353 security flaws. Five critical bugs are memory corruption in Skia, Accessibility, CSS, Paint, and WebRTC, and a sixth is a use-after-free in Accessibility. The advisory does not describe full exploit chains and may restrict bug details until most users update. High-severity fixes also cover Site Isolation, the file system, ANGLE, V8, GPU, and networking.
Unconfirmed: Google has not confirmed exploitation, and the notice does not show whether each critical bug yields full device compromise.
- Xinyang Ge, credited with help from Claude, reported several critical memory bugs.
- OpenAI Codex Security reported the critical WebRTC flaw on October 15.
- Google paid $10,000 for Site Isolation bug CVE-2026-113101.
- Users must relaunch Chrome; downloading the update alone does not install it.
Impact: Memory corruption or use-after-free in Chrome components
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | before 156.0.8078.47 on Linux and before 156.0.8078.47/.48 on Windows and Mac | 156.0.8078.47 (Linux); 156.0.8078.47/.48 (Windows and Mac) |
- 1.Update Chrome to 156.0.8078.47 or .48 and relaunch the browser.
- 2.Use Chrome Enterprise policies to require restarts on managed devices.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-113072 | CSS memory corruption in Chrome before 156.0.8078.47 | 9.6 group max | — |
From the original article
2 min read at cybersecuritynews.com
Google released Chrome 156 for Windows, macOS, and Linux on October 20, 2026, fixing 353 security flaws, including six critical bugs across graphics, accessibility, rendering, and communication features. Google says the release will reach users over the coming days and weeks. The patched versions are 156.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.