Google Chrome 156 Update Fixes 353 Security Flaws, Including Six Critical Vulnerabilities

Google has released Chrome 156 security updates for Windows, macOS and Linux, fixing 353 security flaws, including six critical vulnerabilities across graphics, accessibility, rendering and communication components. The update was released on October 20, 2026, and is expected to reach users gradually over the coming days and weeks.

According to the supplied release notice, the patched versions are 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and macOS. Users should check whether their browsers have received the update and restart Chrome after installation to ensure the fixes take effect.

Six Critical Vulnerabilities Addressed

Google's security advisory identifies six critical vulnerabilities, five involving memory corruption and one involving a use-after-free error.

Advertisement

The reported vulnerabilities include:

1. CVE-2026-113341: Memory corruption in Skia.
2. CVE-2026-113279: Memory corruption in Accessibility.
3. CVE-2026-113072: Memory corruption in CSS.
4. CVE-2026-113280: Memory corruption in Paint.
5. CVE-2026-113303: Memory corruption in WebRTC.
6. CVE-2026-113271: Use-after-free vulnerability in Accessibility.

Memory corruption can cause software to behave unpredictably and may create security risks. A use-after-free flaw occurs when software accesses memory after it has been released, potentially creating an avenue for exploitation.

However, the available advisory information does not establish a complete attack chain for these vulnerabilities or confirm that they are being actively exploited.

Researchers and AI Tools Receive Security Credits

The advisory credits several researchers for identifying vulnerabilities. Google reported the Skia issue internally, while researcher Xinyang Ge reported flaws involving Accessibility, CSS and Paint.

The Accessibility use-after-free finding is credited to Ge of Anthropic, assisted by Claude. OpenAI Codex Security, identified as kylebot, reported the critical WebRTC vulnerability on October 15.

These acknowledgements highlight the growing presence of AI tools in cybersecurity research. However, the available information does not specify how much of each discovery was automated.

Additional High-Severity Bugs Fixed

Beyond the six critical vulnerabilities, Chrome 156 addresses high-severity issues in components including SiteIsolation, FileSystem, ANGLE, V8, GPU and Network.

The reported flaw types include memory corruption, use-after-free errors, improper input validation and out-of-bounds reads.

Google also awarded $10,000 for CVE-2026-113101, a SiteIsolation use-after-free vulnerability reported by Quyen Son at VinFast.

The release follows earlier Chrome security updates during October, including patches reported to address 247 and 37 vulnerabilities. Google has not stated in the supplied information that the six critical flaws in Chrome 156 are being exploited in active attacks.

How to Update Google Chrome

Users can check for the latest version through Chrome's built-in update settings.

1. Open Google Chrome on your computer.
2. Select the three-dot menu in the upper-right corner.
3. Go to Help and select About Google Chrome.
4. Allow Chrome to check for available updates.
5. Select Relaunch when prompted to complete the update.

Google may restrict access to detailed vulnerability information until enough users have received the fixes or affected third-party projects have addressed related issues.

Users and organisations should install the available security update promptly and ensure that browsers restart successfully. Keeping Chrome updated helps protect against known vulnerabilities as fixes become available.