Chrome 156 Stable Release Patches 353 Vulnerabilities Including Six Critical Flaws

Google promoted Chrome 156 to the stable channel on Tuesday, delivering patches for 353 security vulnerabilities across Windows, macOS, and Linux platforms. This release addresses a significant volume of defects, continuing the browser vendor’s routine of addressing memory safety issues as Threat Times reported on 2026-10-21 regarding similar memory corruption and use-after-free errors in this update cycle.

The majority of the resolved defects involve memory safety, with 163 classified as memory corruption bugs and 125 identified as use-after-free issues. An additional 17 out-of-bounds read vulnerabilities were fixed. Among the remaining weaknesses, 36 were categorized as improper input validation flaws. These categories dominate the technical breakdown of the security advisory released by the search giant.

Severity and Exploitation Status

The update resolves six critical-severity vulnerabilities, consisting of five memory corruption defects and one use-after-free bug. Beyond the critical tier, Chrome 156 addresses 61 high-severity security issues, 197 medium-severity flaws, and 89 low-severity weaknesses. According to the advisory, Google has not indicated that any of these vulnerabilities are currently being exploited in the wild.

Bug Bounty and Discovery Sources

Google distributed $50,000 in bug bounties for 24 of the vulnerabilities, though the final payout total is expected to be higher as amounts for 44 flaws remain undisclosed. Quyen Son at VinFast received the highest individual reward of $10,000 for a high-severity use-after-free issue in Site Isolation. No bug bounty rewards were paid for 285 vulnerabilities, which were found by Google, Xinyang Ge at Anthropic, or OpenAI Codex Security.

Affected Versions and Platforms

The latest Chrome iteration is rolling out as versions 156.0.8078.47 and 156.0.8078.48 for Windows and macOS users. Linux users are receiving version 156.0.8078.47. These version strings confirm the stable release is now available for download across all major desktop operating systems supported by the browser.

What should you do?

Security teams should verify that all managed endpoints have successfully updated to the latest stable version. Administrators should review patch deployment logs to ensure no devices are running older, vulnerable builds. Monitoring for any unexpected browser behavior remains prudent until all systems are confirmed updated.

Background: Memory corruption bugs

Detect memory corruption by monitoring for access violations, checking heap metadata integrity, and analyzing control flow anomalies. Use fuzzing and static analysis to find hidden bugs before they exploit system vulnerabilities.

Read the full guide: Detect Memory Corruption Bugs: Signals, Tools and Hidden Blind Spots

What to do and how to stay safe: Google Chrome

• Verify all managed devices have installed Chrome 156.0.8078.47 or newer.
• Check for any blocked update notifications or policy restrictions preventing automatic installation.
• Monitor internal logs for unusual browser activity that might indicate exploitation attempts.
• Ensure organizational security policies require prompt installation of critical browser updates.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many critical vulnerabilities are fixed in Chrome 156?

The update resolves six critical-severity vulnerabilities, including five memory corruption defects and one use-after-free bug.

Are any of these flaws being exploited in the wild?

Google states that it has not reported any of these vulnerabilities being exploited in the wild.

Who received the highest bug bounty for this release?

Quyen Son at VinFast received the highest reward of $10,000 for a high-severity use-after-free issue in Site Isolation.