Chrome 156 Fixes 353 Vulnerabilities, Including Six Critical Flaws
Vulnerability Disclosure · 9 sources · Updated 8d ago · First seen Oct 21, 2026
Google released Chrome 156 to the stable desktop channel with 353 security fixes, most involving memory safety. The update addresses six critical, 61 high, 197 medium, and 89 low-severity vulnerabilities. Critical flaws affect Skia, Accessibility, CSS, Paint, and WebRTC; high-severity issues span components including ANGLE, V8, SiteIsolation, rendering, and navigation. Google did not report active exploitation or disclose exploit prerequisites.
The patched versions are 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and macOS, rolling out over the coming days or weeks. Organizations should prioritize deployment and verify that managed endpoints receive the update. Some vulnerability details remain restricted until users and affected downstream projects receive fixes. Google disclosed $50,000 in bug bounty payments, with rewards for another 44 vulnerabilities still undisclosed, and credited several discoveries to Xinyang Ge of Anthropic assisted by Claude and to OpenAI Codex Security.
