Google has rolled out Chrome 156 to the stable channel in one of the largest security patch drops in the browser's recent history, fixing 353 security vulnerabilities -- including six rated critical. The release, announced on October 20, dwarfs the previous Chrome 155 update, which addressed just 37 security issues, and it comes in a week when browser security teams have been working overtime on multiple fronts.
The update is shipping as version 156.0.8078.47 and .48 for Windows and macOS, and 156.0.8078.47 for Linux, with the deployment continuing over the coming days and weeks. Android users will receive the same Chrome 156 update through the Play Store over the next few days, carrying the exact same security patches under the hood.
Six Critical Flaws, Hundreds of Fixes
By severity, Chrome 156 resolves six critical, 61 high, 197 medium and 89 low-severity issues. Memory-safety defects dominate the release: Google's breakdown identifies 163 memory-corruption issues, 125 use-after-free vulnerabilities and 17 out-of-bounds reads, along with 36 improper-input-validation flaws and fixes across other weakness categories.
The six critical vulnerabilities are CVE-2026-113341 in Skia, CVE-2026-113279 in Accessibility, CVE-2026-113072 in CSS, CVE-2026-113280 in Paint, CVE-2026-113271 in Accessibility and CVE-2026-113303 in WebRTC. Five involve memory corruption; the Accessibility issue is a use-after-free condition.
These are the kind of flaws where visiting a rigged webpage could theoretically let an attacker crash the browser and run malicious code without the victim clicking a thing -- although the practical impact of each flaw depends on its exploitability and Chrome's layered defences.
Beyond the critical issues, the update fixes high-severity weaknesses in SiteIsolation, FileSystem, ANGLE, V8, GPU, Navigation and other components. Google's advisory does not identify a threat actor or state that any of the six critical vulnerabilities has been exploited in the wild, and several bug details remain restricted while users complete the update rollout.
Access to bug details and links may be kept restricted until a majority of users are updated, Google said -- a standard practice to avoid handing attackers a roadmap before patches land.
AI Tools Among the Bug Hunters
One of the release's most talked-about aspects is who found the bugs. Google's release notes credit several findings to external researchers working alongside AI systems. Xinyang Ge of Anthropic reported the Accessibility use-after-free bug with assistance from Claude, and OpenAI Codex Security -- identified as kylebot -- reported the critical WebRTC memory-corruption flaw on October 15.
Other AI-credited findings include vulnerabilities affecting V8, Turbolev, Date, ServiceWorker, DisplayLocking and PDF components.
The credits document AI's growing involvement in vulnerability research without establishing how independently the systems performed each investigation. But the direction of travel is clear: AI tools are now finding the vulnerabilities fast enough to be credited in official advisories, which helps explain why Google is also using its own Gemini AI to sniff out fake antivirus warnings and phishing traps before they reach users.
Bug Bounties and the Scale of the Haul
Google paid out thousands of dollars in bounty rewards to independent researchers. The largest disclosed payout was $10,000 for CVE-2026-113101, a SiteIsolation use-after-free flaw reported by Quyen Son at VinFast, while a FileSystem use-after-free issue earned $3,000 and several additional reports earned $2,000 or $1,000.
The scale of the release -- roughly ten times the size of Chrome 155 -- follows earlier October patch rounds, including an update that fixed 247 vulnerabilities and another that addressed 37. It has been a busy month for browser patching, and the Chrome 156 drop arrives in the same week that Chrome and Firefox were forced to block flawed eMudhra security certificates after a Bengaluru certificate authority was found to have generated dangerously weak keys.
Browser security teams are clearly working overtime on every front.
Why This Matters to You
For the hundreds of millions of people who use Chrome in India and around the world, the message is simple: update now. Most users will receive the patch automatically, but the update is not complete until the browser restarts.
To update Google Chrome: open the browser, click the three-dot menu in the top-right corner, select Help, then choose About Google Chrome. Chrome will automatically check for updates and download the latest version; after the download completes, click Relaunch to finish installing. On office-managed computers, administrators can also use Chrome Enterprise tools to ensure browsers restart after receiving security updates.
Simply downloading the patch is not enough -- the relaunch step is what activates the fixes.
The memory-safety defects that dominate this release are the continuing weak spot of modern browsers. Chrome's renderer is written in languages where memory errors are common, and attackers routinely probe those errors for ways to escape the sandbox. Each patched flaw closes a potential foothold, which is why security teams stress that speed of update matters as much as the patch itself.
The severity ratings paint a clear picture of the risk. One of the six critical flaws -- the CSS memory-corruption bug CVE-2026-113072 -- carries a CVSS v3 score of 9.6, deep into critical territory, while the other critical CVEs are rated between 6.5 and 8.8.
Even the "lower" critical bugs represent serious exposure for a product installed on billions of devices, since a successful exploit can potentially enable code execution in Chrome's renderer or provide a foothold for further sandbox-escape research.
For users unsure whether they are protected, checking is quick: the version number on the About Google Chrome page should read 156.0.8078.47 or higher. Chrome checks for available updates automatically on that page, and the Relaunch prompt confirms the new version is installed.
In managed enterprise environments, IT administrators should treat the rollout as a priority deployment rather than a routine background update, given the number of remotely triggerable memory-safety flaws addressed.
A Busy Month Gets Busier
Chrome 156 caps a hectic stretch for browser security. The eMudhra certificate incident, the 247-flaw October patch round and now a 353-fix stable release have arrived within days of each other -- a reminder that the software billions rely on every day needs constant, quiet maintenance. For users, the maintenance is simple: keep the browser updated and restart it when asked. For the researchers -- human and AI alike -- the hunt for the next flaw has already begun.
(Reporting based on GBHackers, Cybersecurity News, SparTech Software, PiunikaWeb, CyberPress and The Hans India.)