Chrome 156 ships 353 security fixes, six of them rated Critical

Chrome 156 ships 353 security fixes, six of them rated Critical

20 October 2026: Google has promoted Chrome 156 to the stable channel for Windows, Mac and Linux with 353 security fixes, six rated Critical, all of them memory corruption or use after free bugs in Skia, Accessibility, CSS, Paint and WebRTC. The release post does not say that any of the flaws is being exploited, and the update rolls out over the coming days and weeks.

Versions that carry the fixes

• Linux: 156.0.8078.47
• Windows and Mac: 156.0.8078.47 or 156.0.8078.48

Android has its own release post for the same milestone. Managed fleets that pin Chrome to the previous milestone through policy will stay on Chrome 155 until an administrator moves them; our earlier advisory on Chrome 155.0.8059.84 covers the last update on that line.

The six Critical bugs

Counted from the release post, the severity split is 6 Critical, 61 High, 197 Medium and 89 Low, which adds up to the 353 fixes Google states.

CVE	Component	Bug class	Reported
CVE-2026-113341	Skia	Memory corruption	3 October, by Google
CVE-2026-113279	Accessibility	Memory corruption	5 October
CVE-2026-113072	CSS	Memory corruption	6 October
CVE-2026-113280	Paint	Memory corruption	6 October
CVE-2026-113271	Accessibility	Use after free	8 October
CVE-2026-113303	WebRTC	Memory corruption	15 October

Skia is the graphics library that draws every page, and Paint and CSS sit on the same rendering path, so a crafted page is the obvious delivery route for bugs of this kind. WebRTC handles browser calls and screen sharing, which matters in companies that run meetings in the browser. Several of the Critical and High reports came from automated or machine-assisted bug hunting, and the post credits external researchers with bounties of up to $10,000 on individual High entries, such as a use after free in Site Isolation.

Why a count this size changes the patch plan

The last Chrome 155 update we covered fixed ten bugs; this milestone fixes 353, most of them found in the weeks before release, and Google keeps bug details restricted "until a majority of users are updated with a fix". Once that restriction lifts, the diffs are public and anyone can work backwards from them to the flaw, which is why the gap between release and full rollout is the useful window for administrators.

Two practical points follow. Chrome's staged rollout means some machines will not see the update for days unless an administrator pushes it, and browsers that embed Chromium, from Edge to Electron apps, ship the same fixes on their own schedules. Inventory tools that report the browser version per device make it easy to check that 156.0.8078.47 or later has actually landed rather than assuming the auto-updater did its job.

Sources

• Chrome Releases: Stable Channel Update for Desktop (Chrome 156), 20 October 2026
• iThome: Chrome 156 and Firefox security updates, 21 October 2026