Skip to content
audiotale.net
Sign in
NewsNews

Chrome 156 (156.0.8078.47) fixes 353 security bugs, six Critical: how to update

Google's 20 October Stable release lists 353 security fixes, including six Critical memory-corruption bugs, two of them credited to AI tools; none is flagged as exploited.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Google promoted Chrome 156 to the Stable channel on 20 October 2026 with 353 security fixes, six of them rated Critical. The desktop builds are 156.0.8078.47 on Linux and 156.0.8078.47/.48 on Windows and Mac. Google's notice does not say that any of the bugs are being exploited, so this is a very large routine patch release rather than an emergency, but the Critical bugs are memory-corruption flaws in the renderer-facing parts of the browser, and the fix only takes effect once Chrome has been relaunched. The credits are also notable: several of the Critical and High bugs were found with AI assistance.

Key points

  • Chrome 156 reached Stable on 20 October 2026: 156.0.8078.47 (Linux), 156.0.8078.47/.48 (Windows, Mac), and it rolls out "over the coming days/weeks", according to Google.
  • The release lists 353 security fixes. By our count of Google's list: 6 Critical, 61 High, 197 Medium and 89 Low.
  • The six Critical bugs are CVE-2026-113341 (Skia), CVE-2026-113279 (Accessibility), CVE-2026-113072 (CSS), CVE-2026-113280 (Paint), CVE-2026-113271 (Accessibility) and CVE-2026-113303 (WebRTC).
  • Google's notice does not mark any of them as exploited in the wild.
  • An early-stable build of Chrome 157 (157.0.8103.15/.16 for Windows) began reaching a small share of users on 22 October.

What to do

  • Update: open the three-dot menu, then Help, then About Google Chrome. Chrome checks for the update; click Relaunch when asked. A downloaded update is not applied until the browser restarts.
  • Check your build: type chrome://version in the address bar. You should see 156.0.8078.47 or .48 (Windows, Mac) or .47 (Linux). On Android the build is 156.0.8078.47 and on iOS 156.0.8078.46, per the release summary at Chrome Geek. ChromeOS moved to 16836.19.0, which carries browser 156.0.8078.42.
  • Managed fleets: administrators can use Chrome Enterprise policies to prompt or require relaunches after an update is pending.
  • Other Chromium browsers (Edge, Brave, Opera, Vivaldi and so on) ship the Chromium fixes on their own schedule; check each vendor's release notes rather than assuming they match.
  • Not yet offered the update? The rollout is staged. Use the manual check above; if nothing is offered, your machine has not been reached yet.

What happened

Google's Chrome Releases blog published the "Stable Channel Update for Desktop" on 20 October 2026. It promotes Chrome 156 for Windows, Mac and Linux and says the build "contains a number of fixes and improvements". The security section states that the update includes 353 security fixes and lists each by severity, component, reporter and bounty.

The six Critical entries are:

  • CVE-2026-113341, memory corruption in Skia, reported by Google on 3 October.
  • CVE-2026-113279, memory corruption in Accessibility, reported by Xinyang Ge on 5 October.
  • CVE-2026-113072, memory corruption in CSS, reported by Xinyang Ge on 6 October.
  • CVE-2026-113280, memory corruption in Paint, reported by Xinyang Ge on 6 October.
  • CVE-2026-113271, use after free in Accessibility, reported by Xinyang Ge (Anthropic), assisted by Claude, on 8 October.
  • CVE-2026-113303, memory corruption in WebRTC, reported by OpenAI Codex Security (credited to "kylebot") on 15 October.

The Critical entries carry no bounty figure ("N/A") in Google's list. The largest reward visible in the High group is $10,000 for CVE-2026-113101, a use after free in SiteIsolation reported by Quyen Son at VinFast on 13 September. Many of the High entries are in ANGLE (the graphics translation layer), V8 (the JavaScript engine), GPU, Network and similar components; the bug types are memory corruption, use after free, improper input validation and out-of-bounds reads.

Google's standard note applies: access to bug details and links may be kept restricted until a majority of users are updated, and also when a bug sits in a third-party library that other projects have not yet fixed. That means the public descriptions are one line each, and nobody outside Google can yet say how reachable any individual bug is.

Background

Chrome ships a new major version roughly every four weeks, and security fixes arrive in every release, but the counts have grown. Security trade press covering earlier October releases described patch rounds of 37 and 247 fixes; we have not checked those against Google's own notices, so treat them as reported figures. What stands out in 156 is the volume, and the credit lines suggest why. Of the 353 entries, we count 266 credited to "Google" as the reporter, which is consistent with Google's internal teams and automated tooling producing most of the finds. Another 15 entries name Xinyang Ge, and five of those say "(Anthropic), assisted by Claude". Four entries are credited to OpenAI Codex Security.

We covered the Anthropic side of this trend recently, when Anthropic used Claude to cut OpenSSH's pre-login attack surface. The Chrome credit lines are a second, public data point: AI-assisted finders are now listed by name alongside human researchers and Google's own teams in one of the most heavily audited codebases in the world.

The numbers

The split by severity, counted from Google's list (the same split Chrome Geek reports):

Chrome 156 security fixes by severityfixes
Chrome 156 security fixes by severity (fixes)
fixes
Medium197
Low89
High61
Critical6

Source: Google Chrome Releases, Stable Channel Update for Desktop, 20 October 2026 (our count)

A few other figures worth knowing, all taken from the same list: the Critical bugs were reported between 3 and 15 October, so the newest one (WebRTC, reported 15 October) was fixed and shipped within five days. By our count, 266 of the 353 entries are credited to Google, 15 name Xinyang Ge, five carry the "assisted by Claude" credit and four are credited to OpenAI Codex Security. These are our tallies of a long list and could be off by one or two; the severity totals match the independent count at Chrome Geek.

What it means

For everyday users: relaunch Chrome. The risk from a Critical memory-corruption bug in a renderer-facing component is that a booby-trapped page could, in the worst case, run code inside the browser's sandbox, and a second bug would be needed to escape it. Google has not said that an attack chain exists, and security press coverage notes that severity ratings alone do not prove a complete compromise. But there is no reason to run a build with six known Critical flaws.

For IT teams: 353 fixes in one release makes "we will update next month" a poor policy. Use the enterprise relaunch policies, and verify the version that endpoints report rather than the version you deployed. Chromium-based browsers and Electron apps lag Chrome, sometimes by weeks.

For developers of Chromium-based software: several components named here (ANGLE, V8, Skia, WebRTC) are shared libraries. Google warns that bug details can stay restricted when a third-party library is involved, so track the upstream releases for your embedded version.

For the industry: the credits show vulnerability research becoming a mixed human and AI activity. The AI-assisted entries are a small share of the total, and Google's list does not describe how much of each find was automated, so it would be wrong to read them as fully automated discoveries. They do show that vendors are crediting AI tools and the people who direct them in the same field.

What we don't know yet

  • Whether any of the 353 bugs have been or will be exploited. Google's notice does not flag any.
  • The technical details of the six Critical bugs. They are restricted for now.
  • How much of each AI-credited find was done by the tool and how much by the researcher. The credit lines do not say.
  • Exactly when the rollout will reach every user; Google says only "coming days/weeks".
  • Whether the early-stable 157 builds will carry more security fixes. Google's early-stable post on 22 October gives no list.

What to watch next

Chrome 157 is already in early stable on Windows (157.0.8103.15/.16, announced 22 October to a small percentage of users, with Mac to follow). The full Stable release should bring its own list of fixes. Watch the Chrome Releases blog for any note that a 156 bug is being exploited, and watch Microsoft Edge, Brave and other Chromium vendors for their matching updates.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next