Chrome 156 Fixes Memory Corruption Bugs Across Windows, macOS and Linux Environments
The latest stable release fixes memory corruption and use-after-free errors across Windows, macOS and Linux environments.
Key points
- Chrome 156 resolves 353 vulnerabilities, including six critical flaws in graphics and accessibility components.
- AI-assisted research contributed to findings, with credits to Anthropic and OpenAI Codex Security.
- Deployment continues over days and weeks; users must restart browsers to apply fixes.
Google released Chrome version 156 to the stable channel on 20 October 2026, addressing 353 security vulnerabilities. This update covers Windows, macOS and Linux platforms. The release includes six critical flaws, primarily involving memory corruption and use-after-free errors. These defects affect core browser components such as graphics rendering, accessibility features and networking interfaces.
Root cause
The critical vulnerabilities stem from memory safety issues. Five involve memory corruption within Skia, Accessibility, CSS, Paint and WebRTC components. The sixth is a use-after-free error in Accessibility. High-severity flaws also impact ANGLE, V8 and GPU processing. These bugs allow unintended memory access or improper input validation.
Attack path
Google does not disclose specific exploitation prerequisites or complete attack chains for these flaws. The advisory notes that severity ratings alone do not confirm full device compromise. Researchers identified the issues through internal testing and external reports. AI tools assisted some researchers, but the extent of automation remains unclear.
Affected versions
- Linux: Chrome 156.0.8078.47
- Windows and macOS: Chrome 156.0.8078.47 and 156.0.8078.48
Mitigation
- Update Chrome to the latest stable version immediately.
- Restart the browser after updating to ensure fixes are active.
- Verify installed versions match the patched releases listed above.
What it means for organisations
Teams should assess their browser update policies to ensure rapid deployment. Security operations centres need to monitor for unusual network activity that might indicate exploitation. Procurement teams should review vendor update timelines for third-party applications relying on browser components. Internal communications should alert staff to restart applications after updates. Risk managers must evaluate the impact of delayed patching on compliance requirements.
What to do and how to stay safe: Google Chrome
- Check current Chrome versions against the patched releases.
- Monitor for unexpected browser crashes or permission requests.
- Review extension permissions to reduce attack surface.
- Ensure automated update mechanisms are functioning correctly.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AI tools assisted in finding these vulnerabilities?
Anthropic’s Claude assisted researcher Xinyang Ge, and OpenAI Codex Security reported a WebRTC flaw.
How many critical flaws are in Chrome 156?
There are six critical vulnerabilities, mostly involving memory corruption.
When was Chrome 156 released?
Google released it to the stable channel on 20 October 2026.
