Google Chrome Update Patches 353 Flaws, 6 Critical Vulnerabilities

Key Takeaways

• Google has released Chrome version 156 for Windows, macOS, and Linux to address 353 security vulnerabilities.
• This extensive update includes fixes for six critical security flaws, primarily involving memory corruption and use-after-free issues.
• The patched versions are 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac.
• Users are strongly advised to update their Chrome browsers immediately to mitigate potential risks.

Extensive Chrome Update Patches 353 Flaws, Including Six Critical Vulnerabilities

Google has rolled out a significant security update for its Chrome browser, version 156, across Windows, macOS, and Linux platforms. Released on October 20, 2026, this update resolves a staggering 353 security vulnerabilities, with six of these classified as critical. The addressed flaws impact various core browser functionalities, including graphics rendering, accessibility features, and communication protocols.

The update, which Google states will progressively reach users over the coming days and weeks, brings the browser to version 156.0.8078.47 for Linux and versions 156.0.8078.47 or .48 for Windows and Mac. To ensure the security patches are fully applied, users must verify their installed Chrome version and restart the browser after the update process completes.

Critical Vulnerabilities Addressed

According to Google’s official security advisory, five of the six critical vulnerabilities are characterized as memory corruption issues. These include CVE-2026-113341 impacting Skia, CVE-2026-113279 found in Accessibility features, CVE-2026-113072 affecting CSS, CVE-2026-113280 within Paint, and CVE-2026-113303 related to WebRTC. The sixth critical flaw, identified as CVE-2026-113271, is a use-after-free vulnerability also present in Accessibility components.

Use-after-free bugs are a dangerous class of vulnerability where a program attempts to access memory that has already been deallocated. This can lead to crashes, arbitrary code execution, and other severe security implications. While the public notice identifies these critical flaws, it refrains from detailing specific exploitation methods or confirming complete attack chains, meaning the full impact of these vulnerabilities remains partially undisclosed.

Researcher Contributions and AI Involvement

The security advisory credits several researchers for their contributions to identifying these vulnerabilities. The Skia issue was reported internally by Google. Xinyang Ge is recognized for discovering memory corruption flaws in Accessibility, CSS, and Paint. Ge, affiliated with Anthropic, is also credited for the Accessibility use-after-free finding, with assistance from Claude. Notably, OpenAI Codex Security, operating under the moniker kylebot, reported the critical WebRTC vulnerability on October 15.

The mention of AI tools like Claude and kylebot alongside human researchers highlights the increasing role of artificial intelligence in vulnerability discovery within the browser security landscape. However, the advisory does not elaborate on the precise extent of AI involvement in each finding, cautioning against interpreting these credits as proof of fully automated discovery for every reported issue.

Broader Security Enhancements

Beyond the critical fixes, Chrome 156 addresses a multitude of high-severity weaknesses across various browser components, including SiteIsolation, FileSystem, ANGLE, V8, GPU, and Network. Common bug types resolved in this update include additional memory corruption issues, use-after-free errors, improper input validation, and out-of-bounds read vulnerabilities. Google awarded a bounty of $10,000 for CVE-2026-113101, a SiteIsolation use-after-free flaw reported by Quyen Son at VinFast.

This release continues a busy month for Chrome security, following previous October updates that resolved 247 and 37 vulnerabilities respectively. Those earlier patches also included critical memory-safety bugs, underscoring Google’s ongoing commitment to browser security.

Google’s announcement does not indicate that any of the six critical vulnerabilities are currently being actively exploited in the wild. Access to detailed bug information may also remain restricted until a majority of users have applied the fixes, or until any affected third-party projects have addressed shared issues, thereby limiting public knowledge of exploitation specifics.

What You Should Do

• Update Immediately: Navigate to your Chrome browser menu (three dots), select Help, then “About Google Chrome.” The browser will automatically check for updates.
• Restart Chrome: After the update downloads, select “Relaunch” when prompted. The patch will only be applied once the browser restarts.
• Verify Version: Confirm your Chrome version is 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows/Mac) to ensure the update was successful.
• Managed Environments: For enterprise users, administrators should leverage Chrome Enterprise policies to enforce or prompt browser restarts following pending updates, as detailed in Google’s update instructions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.