Google Chrome 156 Patch Resolves 353 Flaws Including Six Critical Bugs

Google deployed Chrome version 156 to the stable update channel for Windows, macOS, and Linux on October 20, 2026. This release resolves 353 distinct security vulnerabilities, including six rated as critical severity, according to GBHackers. The update marks a significant maintenance cycle for the browser, continuing the pattern of regular stability and security improvements seen in recent months.

The update installs version 156.0.8078.47 on Linux systems and versions 156.0.8078.47 or 156.0.8078.48 on Windows and macOS platforms. Google stated that the full deployment will proceed over subsequent days and weeks. The fixes target defects in graphics rendering, accessibility features, networking stacks, browser interfaces, extensions, and storage mechanisms. As Threat Times reported on October 21, 2026, this release also coincides with changes to how the browser handles clipboard data for safety screening.

Vulnerability Details and AI Research

Five of the six critical vulnerabilities involve memory corruption, a common class of bugs that can allow attackers to execute arbitrary code. The sixth critical flaw, identified as CVE-2026-113271, is a use-after-free error affecting the Accessibility component. Google’s announcement provides severity ratings and component details but does not disclose specific exploitation prerequisites or complete attack chains for these issues.

The Skia vulnerability was identified internally by Google. External researcher Xinyang Ge reported the critical Accessibility, CSS, and Paint memory corruption issues. Notably, Ge utilized assistance from Anthropic’s Claude during the discovery process, highlighting the growing role of artificial intelligence in security research.

Another critical flaw in the WebRTC component was reported by OpenAI Codex Security, operating under the handle “kylebot.” These acknowledgments underscore a shift toward AI-assisted discovery methods in this release cycle. The update also addresses high-severity vulnerabilities in the ANGLE graphics library, including memory corruption, use-after-free errors, improper input validation, and out-of-bounds read issues.

Affected Components and Rewards

High-severity fixes also cover the V8 JavaScript engine, GPU processing, Canvas, Navigation, FileSystem, and WebRTC components. V8 updates address both memory corruption and use-after-free vulnerabilities, demonstrating that multiple defect classes exist within single components. Additional high-severity entries impact Site Isolation, password management, privacy features, ServiceWorkers, PDF functionality, and the browser installation process.

Google awarded $10,000 to Quyen Son at VinFast for reporting CVE-2026-113101, a Site Isolation use-after-free vulnerability. A $3,000 reward was issued for the FileSystem use-after-free issue, tracked as CVE-2026-113097. Smaller awards remain pending determination. Google indicated that access to detailed bug information may stay restricted until most users have installed the necessary fixes.

What should you do?

Users should verify that their Chrome browsers have automatically updated to version 156 or later. Administrators managing enterprise environments should confirm deployment status across Windows, macOS, and Linux endpoints. Monitoring for further announcements from Google regarding restricted bug details is advisable.

What to do and how to stay safe: Google Chrome

• Check your browser version by navigating to the settings menu and ensuring it matches 156.0.8078.47 or higher.
• Force a manual update if the automatic rollout has not yet reached your specific device or operating system.
• Review enterprise update policies to ensure rapid deployment of critical security patches to all managed devices.
• Monitor official Google security blogs for any additional details on exploitation risks as they become available.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific version of Chrome fixes these vulnerabilities?

Linux users should install 156.0.8078.47, while Windows and macOS users should install 156.0.8078.47 or 156.0.8078.48.

Are there critical flaws in this update?

Yes, six critical vulnerabilities are addressed, including five memory corruption bugs and one use-after-free error in Accessibility.

Did AI tools help discover any of these bugs?

Yes, researcher Xinyang Ge used Anthropic’s Claude, and OpenAI Codex Security reported a critical WebRTC flaw.