Chrome 156 fixes 353 vulnerabilities, six of them critical

Original title: Google Chrome 156 Fixes 353 Security Vulnerabilities, Including 6 Critical Flaws

GBHackersby DivyaOct 21, 2026 · 11:26 UTC (9d ago)10 min read2 · 1 read

AI summary · x-ai/grok-4.7Summaries by Vani AI

Linux builds are 156.0.8078.47 and Windows and macOS builds are 156.0.8078.47 or .48; exploitation is not addressed.

Google released Chrome 156 to the stable channel for Windows, macOS, and Linux on October 20, 2026, fixing 353 vulnerabilities: six critical, 68 high, 190 medium, and 89 low. Five critical bugs are memory corruption in Skia, Accessibility, CSS, Paint, and WebRTC; the sixth is a use-after-free in Accessibility. Rollout continues over coming days and weeks, and bug details may stay restricted until most users update. The notice gives no CVSS scores and does not say whether any flaw is exploited.

Unconfirmed: Google does not say whether any of the 353 vulnerabilities are exploited in the wild.

Key facts

Critical Accessibility and WebRTC reports are credited to Anthropic-assisted research and OpenAI Codex Security.
Google awarded $10,000 for Site Isolation use-after-free CVE-2026-113101.
High-severity fixes also cover ANGLE, V8, GPU, Canvas, Navigation, FileSystem, and WebRTC.
The notice does not confirm remote code execution or sandbox-escape chains.

Security assessment · AI, from the article

Impact: Memory corruption and use-after-free in core Chrome components

Product	Affected	Fixed in
Google Chrome	—	156.0.8078.47 for Linux; 156.0.8078.47/.48 for Windows and macOS

What to do

1.Update Chrome to 156.0.8078.47 on Linux or 156.0.8078.47/.48 on Windows and macOS.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Tags: chrome memory-corruption use-after-free browser skia webrtc

Vendors: Google
Products: Chrome
Organizations: Anthropic OpenAI

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-113072 +29 related CVEs CVE-2026-113092 CVE-2026-113141 CVE-2026-113058 CVE-2026-113097 CVE-2026-113101 CVE-2026-113104 CVE-2026-113117 CVE-2026-113119 CVE-2026-113134 CVE-2026-113163 CVE-2026-113188 CVE-2026-113236+17 more	CSS memory corruption in Chrome before 156.0.8078.47	9.6 group max	—		10d ago

From the original article

10 min read at gbhackers.com

Google released Chrome version 156 to the stable channel for Windows, macOS, and Linux, addressing 353 security vulnerabilities, including six critical flaws. Announced on October 20, 2026, this update addresses memory corruption, use-after-free errors, input validation issues, and other weaknesses across various browser components. Google stated that the deployment will continue over the coming days […]

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.