Google has released Chrome 156 to the stable channel with fixes for 353 security vulnerabilities, including six rated critical. The update is rolling out as versions 156.0.8078.47 and .48 for Windows and macOS, and 156.0.8078.47 for Linux, according to Google’s Chrome Releases advisory.
Memory-safety defects dominate the release. Google’s breakdown identifies 163 memory-corruption issues, 125 use-after-free vulnerabilities and 17 out-of-bounds reads. The update also addresses 36 improper-input-validation flaws, while the remaining fixes cover other weakness categories. By severity, Chrome 156 resolves six critical, 61 high, 197 medium and 89 low-severity issues.
The six critical vulnerabilities are CVE-2026-113341 in Skia, CVE-2026-113279 in Accessibility, CVE-2026-113072 in CSS, CVE-2026-113280 in Paint, CVE-2026-113271 in Accessibility and CVE-2026-113303 in WebRTC. Five involve memory corruption; the Accessibility issue is a use-after-free condition.
Google’s release notes credit several findings to external researchers, including Xinyang Ge of Anthropic, who reported the Accessibility use-after-free bug with assistance from Claude, and OpenAI Codex Security, which reported the WebRTC memory-corruption flaw. The advisory does not identify a threat actor or say that any of the six critical vulnerabilities has been exploited in the wild. Several bug details remain restricted while users complete the update rollout.
The scale and composition of the release underscore the continuing risk posed by browser memory-safety errors. A successful exploit can potentially enable code execution in Chrome’s renderer or provide a foothold for further sandbox-escape research, although the practical impact depends on each flaw’s exploitability and the browser’s layered defenses. Public CVSS scores and proof-of-concept exploit code were not available in the cited release information at publication time.
Organizations should prioritize Chrome 156 deployment across managed desktops, verify the installed version through the browser’s About page or endpoint-management tools, and restart instances so the patched components become active. Administrators should also maintain browser auto-update controls and monitor Google’s Chrome security advisories and the National Vulnerability Database for later severity scoring or exploitation updates.
