Chrome 156 ships 353 security fixes, six of them critical
The stable release patches memory-safety bugs in CSS, Paint, WebRTC, Skia and Accessibility. Google says none are exploited in the wild.
Google pushed Chrome 156 to the stable channel on 20 October, version 156.0.8078.47/.48 on Windows and Mac, 156.0.8078.47 on Linux. The release patches 353 security issues, by far the largest batch in recent releases.
Six are rated critical, and all six are memory-safety bugs: memory corruption in CSS (CVE-2026-113072), Accessibility (CVE-2026-113279), Paint (CVE-2026-113280), WebRTC (CVE-2026-113303) and Skia (CVE-2026-113341), plus a use-after-free in Accessibility (CVE-2026-113271). Google’s advisory does not list any of the 353 as exploited in the wild, and none appear in CISA’s Known Exploited Vulnerabilities catalog.
Why it matters: this lands on every Chromium-based browser, not just Chrome, so Edge, Brave and Opera inherit the same fixes once they rebase. Six critical memory-safety bugs in one release is enough reason to update now rather than wait for auto-update to catch up on its own schedule.
The caveat: Google’s write-up gives detail only on the critical six; the other 347, spanning high, medium and low severity, are listed by component without individual descriptions, so you can’t yet tell from the advisory alone which of those might matter most to your own stack.