On 20 October 2026, Google released Chrome 156 for Windows, Mac and Linux, fixing 353 security vulnerabilities, six of which were rated critical. The update affects all desktop platforms: builds 156.0.8078.47 for Linux and 156.0.8078.47/.48 for Windows and Mac. The scale of the patch is one of the largest in Chrome’s history: for comparison, Chrome 153 closed 230 vulnerabilities. All Chrome users on desktop platforms are advised to update immediately.
Six critical vulnerabilities
According to Google’s official security advisory, six CVEs were rated critical. All of them belong to the classes of memory corruption or use-after-free — types of vulnerabilities that can potentially allow arbitrary code execution:
- CVE-2026-113341 — memory corruption in Skia (graphics library), discovered by Google
- CVE-2026-113279 — memory corruption in Accessibility, discovered by Xinyang Ge
- CVE-2026-113072 — memory corruption in CSS, discovered by Xinyang Ge
- CVE-2026-113280 — memory corruption in Paint, discovered by Xinyang Ge
- CVE-2026-113271 — use-after-free in Accessibility, discovered by Xinyang Ge (Anthropic) with assistance from Claude
- CVE-2026-113303 — memory corruption in WebRTC, discovered by OpenAI Codex Security (kylebot)
Google has not published CVSS scores for these vulnerabilities. The bug details and links to them may remain restricted until most users receive the update.
AI systems as vulnerability researchers
A notable aspect of this release is the presence of AI systems in the list of researchers. According to Google’s advisory, the critical CVE-2026-113271 was discovered with the assistance of Claude (Anthropic), and the critical CVE-2026-113303 is attributed to the OpenAI Codex Security team. In addition to the critical issues, AI systems also appear in high-severity vulnerabilities: a use-after-free in V8 (CVE-2026-113044) was likewise discovered by OpenAI Codex Security, and several other high-severity vulnerabilities were found by Xinyang Ge from Anthropic with assistance from Claude. These attributions are confirmed only by Google’s advisory; no independent public confirmation had been found at the time of publication.
Scale and structure of the fixes
In addition to the six critical ones, the advisory lists dozens of high-severity vulnerabilities. The most affected components include:
- ANGLE (graphics abstraction layer) — multiple memory corruptions, use-after-free issues and input validation errors
- V8 (JavaScript engine) — memory corruptions and use-after-free issues
- WebRTC, WebGL, Canvas — multimedia and rendering components
- Navigation, SiteIsolation — isolation and navigation mechanisms
- Extensions — multiple issues in the extensions subsystem
A significant share of the vulnerabilities was discovered by Google’s internal teams. External researchers include Xinyang Ge (both independently and with Anthropic), Arni Hardarson from Neonix Security, Quyen Son from VinFast (who received the highest stated reward of $10,000 for CVE-2026-113101 — a use-after-free in SiteIsolation), as well as a number of independent researchers.
It is also worth noting that one of the medium-severity vulnerabilities (CVE-2026-113079, use-after-free in SiteIsolation) was initially reported back in March 2021, meaning it remained open for more than five years.
Exploitation status
At the time of publication, none of the listed vulnerabilities had been added to the CISA KEV catalog. Google’s advisory contains no indication of confirmed active exploitation. Nevertheless, the critical severity and nature of the vulnerabilities — memory corruption and use-after-free in key rendering and multimedia components — make them attractive targets for exploit development.
Recommendations
- Update Chrome to version 156.0.8078.47 (Linux) or 156.0.8078.47/.48 (Windows/Mac) via the “Help → About Google Chrome” menu
- Restart the browser after updating — patches only take effect after a restart
- Check Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) — they use shared components and will likely receive similar updates in the near future
- For enterprise administrators: given the six critical vulnerabilities in rendering components, prioritize deploying the update without waiting for the standard cycle
Chrome 156 is a large security update with a record number of fixes and six critical vulnerabilities in key browser components. Given that Google restricts access to vulnerability details until a mass user update is completed, the window for safely applying the patch is limited. Update Chrome on all managed devices to version 156.0.8078.47 or higher and make sure automatic updates are enabled for unmanaged workstations.
